Snort only runs ET rules, not Snort VRT
DBa last edited by
I am currently running pfSense 2.1.5-RELEASE (i386) and Snort 18.104.22.168 pkg v3.1.2 with the ETOpen and Snort VRT (tested both free and paid) rules. The Alerts and Blocked tabs show lots of ET alerts and blocks but not one single alert or block from a Snort VRT rule ever. I have been running this for months on two systems with the same results. IPS Policy Selection for Snort is Balanced.
I can not find the reason for this. Anyone got any suggestions?
fragged last edited by
There simply hasn't been anything passing your sensor that would trigger one of the Snort VRT rules.
bmeeks last edited by
Also check that you have not disabled any preprocessors other than perhaps Sensitive-Data and sfPortscan. Generally, disabling lots of preprocessors result in Snort not starting, but if you also check the box to automatically disable preprocessor-dependent rules, then you can easily wind up with the majority of your VRT rules auto-disabled. Not saying this is your situation, but just mentioning as something to check.
foresthus last edited by
I can commit the same behavior. With the version pfsense 2.1.5 and the newest packge of snort the desired rules are not updated anymore.
doktornotor Banned last edited by
2.1.5 is dead. Move on. No fixes will ever appear there.