Snort only runs ET rules, not Snort VRT
-
I am currently running pfSense 2.1.5-RELEASE (i386) and Snort 2.9.6.2 pkg v3.1.2 with the ETOpen and Snort VRT (tested both free and paid) rules. The Alerts and Blocked tabs show lots of ET alerts and blocks but not one single alert or block from a Snort VRT rule ever. I have been running this for months on two systems with the same results. IPS Policy Selection for Snort is Balanced.
I can not find the reason for this. Anyone got any suggestions?
-
There simply hasn't been anything passing your sensor that would trigger one of the Snort VRT rules.
-
Also check that you have not disabled any preprocessors other than perhaps Sensitive-Data and sfPortscan. Generally, disabling lots of preprocessors result in Snort not starting, but if you also check the box to automatically disable preprocessor-dependent rules, then you can easily wind up with the majority of your VRT rules auto-disabled. Not saying this is your situation, but just mentioning as something to check.
Bill
-
Hi there,
I can commit the same behavior. With the version pfsense 2.1.5 and the newest packge of snort the desired rules are not updated anymore.
:(
-
2.1.5 is dead. Move on. No fixes will ever appear there.
