Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort FATAL ERROR

    Scheduled Pinned Locked Moved pfSense Packages
    30 Posts 8 Posters 10.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • bmeeksB
      bmeeks
      last edited by

      The actual source rules are in /usr/local/etc/snort/rules.  In that folder you will find a file for each rule category.  You can go into that folder with a CLI prompt and use grep to find that particular SID.  Once you fix it in the appropriate file, it will stay "fixed" until the next rule update download.  The file given in the error message is the actual list of enabled rules Snort is using for the interface.  That file is rebuilt from the collection of source rules in the folder I mentioned earlier.  So any change you make in the snort.rules file is immediately overwritten each time you stop/start Snort from the GUI.

      The way Snort treats rule synxtax errors is baked into the binary and has nothing to do with the GUI package.  Suricata is better behaved in this area than Snort.  Suricata will print an error about the offending rule, skip it, and then continue loading the rest of the rules.  Snort complains and dies.

      Bill

      1 Reply Last reply Reply Quote 0
      • Raffi_R
        Raffi_
        last edited by

        Thanks bmeeks, that definitely helped. I now know how to find these errors and correct them. The problem is when I fixed that one, I'm getting another one and another one. What are the chances of multiple rules in multiples files being messed up with syntax errors like this? I find this a bit odd. I'm not gonna sit here trying to fix each one either, this can't be normal.

        I guess I may have to give Suricata a try. Can I use my snort disablesid.conf in Suricata? I'm not familiar with Suricata at all.

        1 Reply Last reply Reply Quote 0
        • T
          token
          last edited by

          Having a similar issue, I wanted to play with layer 7 and downloaded OpenAppID rules and such, when I go to turn on my LAN interface in snort I get

          FATAL ERROR: /usr/local/etc/snort/snort_29929_igb1/rules/snort.rules(1262) Rule options must be enclosed in '(' and ')'.

          I go to that path and fix line 1263 (missing a  )  at the end) and the edit doesn't stick when I go to start the interface, come to find out I need to edit the source file but not sure how to find the appropriate file and line.

          1 Reply Last reply Reply Quote 0
          • Raffi_R
            Raffi_
            last edited by

            As bmeeks said above,

            go to /usr/local/etc/snort/rules.

            via SSH or console shell,
            grep -rnw  /usr/local/etc/snort/rules -e <pattern>In your case when, you go to line 1262 that line will have an SID number. The pattern to match in your case will be that SID number, so put that number in at the end after '-e'.
            That should give you the path to the source file that contains the SID number, you can then go in and modify that file and it will keep the change.

            Good luck, in my case, I solved that one issue and got another and another error. I hope that's not the case for you. I'm in the process of switching to Suricata because of this.</pattern>

            1 Reply Last reply Reply Quote 0
            • MacG32M
              MacG32
              last edited by

              The rules contained in this download file are not formatted properly. There are many rules missing proper syntax. If anybody knows who this volunteer is, please contact them to correct the errors in their rules.

              Note - the AppID Open Rules file is maintained by a volunteer contributor and hosted by the pfSense team. The URL for the file is http://files.pfsense.org/openappid/appid_rules.tar.gz.

              To correct this problem in the web GUI, go to Services | Snort | Interfaces. Under Actions, select Edit this Snort interface mapping. Click Categories. Underneath 'Enabled Ruleset: Snort OPENAPPI Rules', uncheck all of the boxes. Click Save. Click Snort Interfaces and click the play icon to start the Snort Interface.

              From what I've seen, Suricata doesn't have the option to enable AppID Open Rules. This option seems only available in Snort.

              Well, hello there...

              1 Reply Last reply Reply Quote 0
              • bmeeksB
                bmeeks
                last edited by

                @raffi30:

                Thanks bmeeks, that definitely helped. I now know how to find these errors and correct them. The problem is when I fixed that one, I'm getting another one and another one. What are the chances of multiple rules in multiples files being messed up with syntax errors like this? I find this a bit odd. I'm not gonna sit here trying to fix each one either, this can't be normal.

                I guess I may have to give Suricata a try. Can I use my snort disablesid.conf in Suricata? I'm not familiar with Suricata at all.

                Yes, the SID MGMT files can be easily used in Suricata.  Both Snort and Suricata share almost identical code for the SID MGMT tab.

                P.S. – as for the errors, my understanding from a third-hand source is the rule maintainer for those OpenAppID rules made some updates recently.  Apparently that's when all the syntax errors crept in.

                Bill

                1 Reply Last reply Reply Quote 0
                • Raffi_R
                  Raffi_
                  last edited by

                  The switch to Suricata was pretty simple. In the pfsense webGUI it's mostly identical. It took me a little googling to figure out how to point it to the correct snort tar.gz file, but it seems to be working fine.

                  1 Reply Last reply Reply Quote 0
                  • bmeeksB
                    bmeeks
                    last edited by

                    @MacG32:

                    The rules contained in this download file are not formatted properly. There are many rules missing proper syntax. If anybody knows who this volunteer is, please
                    From what I've seen, Suricata doesn't have the option to enable AppID Open Rules. This option seems only available in Snort.

                    True … only Snort has OpenAppID functionality.

                    Here is a quick and dirty comparison of Snort and Suricata functionality --

                    OpenAppID (application detection and alerting)
                        Snort - Yes
                        Suricata - No

                    Inline IPS Mode (dropping traffic)
                        Snort - No
                        Suricata - Yes

                    Multi-threaded Detection Engine
                      Snort - No
                      Suricata - Yes

                    Uses All Snort VRT Rules Without Error
                        Snort - Yes
                        Suricata - No (some Snort VRT rules have keywords not recognized by Suricata and will be ignored)

                    Continues Startup After Encountering Rule Syntax Errors
                        Snort - No
                        Suricata - Yes

                    In terms of relative protection, both packages are really about equal.  As you can see in the list above, each package has its pros and cons.  If something like application detection and alerting is important to you, then Snort is what you need.  If Inline IPS Mode dropping of packets (as opposed to implementing firewall block rules) is critical for you, then Suricata is what you need (if your NIC supports Netmap operation).  Both packages can use the entire rule set from Emerging Threats (now Proofpoint), but Suricata will ignore about 70-100 Snort VRT rule because of unsupported keywords.  Suricata will print an error about these rules and then skip loading them.

                    Bill

                    1 Reply Last reply Reply Quote 0
                    • bmeeksB
                      bmeeks
                      last edited by

                      @raffi30:

                      The switch to Suricata was pretty simple. In the pfsense webGUI it's mostly identical. It took me a little googling to figure out how to point it to the correct snort tar.gz file, but it seems to be working fine.

                      Hopefully your Google searching sent you to this Sticky Post in the IDS/IPS forum here:  https://forum.pfsense.org/index.php?topic=124054.0.

                      Bill

                      1 Reply Last reply Reply Quote 0
                      • Raffi_R
                        Raffi_
                        last edited by

                        bmeeks, you're the source of all the information I'm looking for! I literally can't even thank you enough because the forum says I have to wait 1 hour before I can applaud you again :)

                        I have Suricata in the global settings currently pointing to the snort 29110.tar.gz which I believe is the latest.
                        I wish I could have stuck with snort, but that startup issue kills the entire IDS. To me, having some kind of IDS is better than not having one at all. I used to have snort setup with the service watchdog in case it crashed (it did that quite often too), but that wouldn't be a good idea in this case because the watchdog would have tried to keep starting it up and it would have kept failing. It would have just sat there in a constant loop eating up resources.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.