Snort service wont start



  • I have installed Snort package but it wont start? what should i do to make it start
    Please help me with this. Thanks
    Also see attached Files for your reference.





  • Have you checked the system logs to see if Snort is reporting any error?



  • Snort won't start here either. I have the following system log entry:

    snort[1507]: FATAL ERROR: /usr/pbi/snort-amd64/etc/snort/snort_25347_em1/snort.conf(6) Failed to parse the IP address: [8.8.8.8,75.75.75.75,75.75.76.76,127.0.0.1,192.168.0.1,192.168.0.100,192.168.1.0/24,(IPv6 address omitted for security)].

    These addresses represent DNS servers and the WAN side of the firewall (behind a router).

    I tried adding those addresses to the Whitelist in Snort.



  • The short answer is that you have an error in that entry, probably in the IPv6 address. Try removing the IPv6 address and see if that solves the problem.

    If it does then either you had a typo, or IPv6 isn't supported in the version of Snort you're using. What version of pfSense and Snort are you using?



  • pfSense 2.1-RELEASE (amd64)
    built on Wed Sep 11 18:17:48 EDT 2013
    Snort  2.9.4.6 pkg v. 2.6.0



  • @Cry:

    The short answer is that you have an error in that entry, probably in the IPv6 address. Try removing the IPv6 address and see if that solves the problem.

    If it does then either you had a typo, or IPv6 isn't supported in the version of Snort you're using. What version of pfSense and Snort are you using?

    The firewall should be using DHCP.



  • Are you saying that the IPv6 address was automatically added to the configuration, or did you add it yourself?



  • I removed the check on DHCPv6 on the WAN interface, Snort started. Does Barnyard 2 have to run also?



  • @Albert:

    I removed the check on DHCPv6 on the WAN interface, Snort started. Does Barnyard 2 have to run also?

    No, Barnyard2 is not required unless you want to send Snort alerts to a remote database such as Snorby or other tools.

    Bill



  • I can't start snort either.  I have the following in my system log.

    snort[60940]: FATAL ERROR: /usr/pbi/snort-amd64/etc/snort/snort_17037_em0/snort.conf(7) !any is not allowed in EXTERNAL_NET.
    SnortStartup[60790]: Snort START for WAN(17037_em0)…

    I have a simple setup at home.  1 Wan, 1 LAN, no Vlans. I'm a n00b at this, and learning as I go.
    Snort 2.9.4.6 pkg v. 2.6.0
    Only rules running are  running the IPS Policy 'Connectivity'
    I was presuming that error was from a rule, so I tried starting snort w/no rules enabled, but get the same error above.
    In the WAN Preprocessors Section, everything is default, and have all preprocessors enabled except the 'enable sensitive data'

    Any advice?  Thanks in advance,

    Lawrence



  • @LawrenceIII:

    I can't start snort either.  I have the following in my system log.

    snort[60940]: FATAL ERROR: /usr/pbi/snort-amd64/etc/snort/snort_17037_em0/snort.conf(7) !any is not allowed in EXTERNAL_NET.
    SnortStartup[60790]: Snort START for WAN(17037_em0)…

    I have a simple setup at home.  1 Wan, 1 LAN, no Vlans. I'm a n00b at this, and learning as I go.
    Snort 2.9.4.6 pkg v. 2.6.0
    Only rules running are  running the IPS Policy 'Connectivity'
    I was presuming that error was from a rule, so I tried starting snort w/no rules enabled, but get the same error above.
    In the WAN Preprocessors Section, everything is default, and have all preprocessors enabled except the 'enable sensitive data'

    Any advice?  Thanks in advance,

    Lawrence

    Something seems seriously wrong with your snort.conf file based on that error message.  Can you get a copy of that file and post it?  The path is in the error message you posted –

    /usr/pbi/snort-amd64/etc/snort/snort_17037_em0/snort.conf

    Bill



  • Hi bmeeks!  Thanks for your reply!  i've attached the config output.  I have reinstalled the package a few times, and rebooted each time, but get the same error. 
    Thanks again! Lawrence

    [snort config.txt](/public/imported_attachments/1/snort config.txt)



  • @LawrenceIII:

    Hi bmeeks!  Thanks for your reply!  i've attached the config output.  I have reinstalled the package a few times, and rebooted each time, but get the same error. 
    Thanks again! Lawrence

    I see the problem.  How did this value (0.0.0.0)  get in the HOME_NET variable?  It is causing the problem.  It means "any network", so in the definition of EXTERNAL_NET, which is by default "not HOME_NET", that translates to !any which is invalid and hence the error is thrown.  The 0.0.0.0 value in HOME_NET should not be there.

    Just guessing by the fact it is adjacent to the addresses for that pair of Level 3 DNS servers, could this by chance be a typo in a third DNS server's IP address?  Your DNS servers, by default, are added to the HOME_NET variable.

    # Define Local Network #
    var HOME_NET [0.0.0.0,4.2.2.2,4.2.2.3,10.0.1.0/24,96.X.X.X,96.X.X.X,127.0.0.1,208.67.222.222]
    var EXTERNAL_NET [!$HOME_NET]
    

    Bill



  • hey Bill, that was it!  you were correct about the 0.0.0.0, and also the wrong DNS IP (that was a typo)  :-[
    i remember putting in that 0.0.0.0 one day, and forgot all about  it.
    Thank you so much for straightening me out, that was driving me crazy for weeks.

    Lawrence



  • @LawrenceIII:

    hey Bill, that was it!  you were correct about the 0.0.0.0, and also the wrong DNS IP (that was a typo)  :-[
    i remember putting in that 0.0.0.0 one day, and forgot all about  it.
    Thank you so much for straightening me out, that was driving me crazy for weeks.

    Lawrence
    [/quote]

    You're welcome.  Glad you are up and running.

    Bill


Log in to reply