Re: Ruleset advice for beginners
Suporte Lapin Têxtil via Snort-users <[email protected]> Tue, 23 Jun 2026 14:17:44 -0300
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============1407433239140866950== Content-Type: multipart/alternative; boundary="------------mN4VI0JBRCYVsevradoIvs0X" Content-Language: pt-BR This is a multi-part message in MIME format. --------------mN4VI0JBRCYVsevradoIvs0X Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi everyone, I wanted to share a real-world "beginner scenario" post-mortem that happened in my environment today, which perfectly aligns with Michael's advice on testing and hardware dependencies. I recently tried to deploy pfSense-pkg-snort (Snort 2.9.x) on a pfSense CE 2.8.1 box (FreeBSD 15-CURRENT base). Upon a clean installation with a restored ruleset config, the entire network collapsed instantly, and the local console became completely unresponsive, flooded with the following loop: "netmap_transmit [xxxx] re1 drop mbuf that needs checksum offload" What I learned the hard way: 1. Hardware Matters: The firewall was running on Realtek PCIe GbE chips (re driver). The combination of Snort trying to hook into Netmap while Hardware Checksum Offloading, TSO, and LRO were still active globally caused a fatal buffer conflict. 2. The Crash: Netmap dropped every single packet before it hit the OS stack because the Realtek hardware was passing segmented/checksummed packets that the DAQ engine couldn't parse. 3. The Fix: I had to drop to the physical shell, run 'killall -9 snort', flush the 'snort2c' firewall table, and completely purge the package via 'pkg delete'. As Michael perfectly stated, you cannot just drop a premium ruleset out-of-the-box and flip the block switch. In the pfSense/FreeBSD ecosystem, running Snort/Suricata in Inline Mode (Netmap) on Realtek hardware without strictly disabling all hardware offloading beforehand is a recipe for a network-wide outage. We are now migrating the box to a dedicated Intel I350-T4 quad-port NIC to handle the multi-queue and Netmap requirements properly before attempting IPS again. Hope this helps any other beginners troubleshooting console freezes with Netmap and 're' drivers! Best regards, Jarlei Em 22/06/2026 13:35, Michael Steele via Snort-users escreveu: > > There is no way to download a pre-packaged, out-of-the-box ruleset > tailored perfectly to a specific environment right from the start. > > While the Talos Subscriber ruleset gives you rapid, premium threat > updates, even those rules default primarily to alert actions. This is > intentional; if a ruleset dropped traffic by default, it would > instantly break legitimate services on a home network the moment a > false positive triggered. > > PulledPork is exactly the tool you need to change this behavior, but > its base policies (Connectivity, Balanced, and Security) are only the > starting point. To move from passive alerts to active blocking (drop > actions), you need to configure PulledPork to rewrite the rule states > for you. > > Building a custom ruleset that matches your specific network profile > will take a little work, but here is the general approach to get you > started: > > ** > > *1. Enable Inline Dropping in Snort* > > First, make sure Snort is actually configured to drop traffic. If > Snort isn't running in inline mode (using DAQ modules like afpacket or > nfq), changing the rules to drop won't do anything—it will still only > log an alert. you need to ensure your execution mode supports blocking. > > ** > > *2. Leverage PulledPork's Modification Files* > > Instead of editing the massive ruleset manually every day (which gets > overwritten on every update), you use PulledPork’s built-in state > modification files: dropsid.conf, enablesid.conf, and disablesid.conf. > > * *dropsid.conf*: You can add specific Signature IDs (SIDs) or > entire rule categories here. PulledPork will automatically change > the action from alert to drop every time it downloads a new update. > * *disablesid.conf*: Use this to turn off noisy or irrelevant rules > (like specific server vulnerabilities if you aren't running those > servers at home) to reduce overhead and false positives. > > ** > > *3. Start Small and Tune* > > Start by using dropsid.conf on highly reliable, high-severity > categories (like known malware command-and-control communication or > active exploits). Watch your logs closely for a week to catch false > positives before expanding your drop list. > > Tailoring a ruleset is an iterative process, but utilizing PulledPork > to manage the rule modifications is the standard, efficient way to > handle it. > > WINSNORT.com Management… > > -- > > ******************** Established ~ 2003 ********************** > > * FREE Windows Intrusion Detection System (WinIDS) Tutorials * > > * ~~ FREE Windows Support Forums ~~ * > > * Visit @ http://winsnort.com * > > * Snort: Open Source Network IDS - http://snort.org * > > ************************************************************** > > Best regards, > > Michael... > > *From:*Snort-users <[email protected]> *On Behalf Of > *Jonathan Lee via Snort-users > *Sent:* Thursday, June 18, 2026 12:07 PM > *To:* Peter Lyons <[email protected]> > *Cc:* [email protected] > *Subject:* Re: [Snort-users] Ruleset advice for beginners > > You have to set block on alert and inline mode or legacy mode > > Sent from my iPhone > > > > On Jun 18, 2026, at 08:50, Peter Lyons via Snort-users > <[email protected]> wrote: > > > > About a year ago I installed snort3 and pulledpork on ubuntu 24.04 > to provide better protection on my home network. > > I registered and used the LightSPD_ruleset, rule_mode=simple, > ips_policy=balanced > > Got it all working, and auto updating the LightSPD ruleset everyday. > > At the start, I was checking the log $ tail -f > /var/snort/alert_json.txt to see if it was working. > > So I felt very happy and secure. > > Then the other day I checked the log file a bit more and noticed > the log file only had *alert warnings* and no rule actions like > block or drop etc. > > So then I checked the LightSPD_ruleset and noticed that by default > the rule actions are all set to *alert warnings.* > > Which means I have to monitor the log file and customize the rules > myself. > > While I’d call myself a linux enthusiast, I don’t have the > expertise to do that. > > *Is there a way to get a rule set suitable for a home network?* > > I’m thinking there might be a community rule set suitable or pay > for a subscribed Talos ruleset. > > I’m assuming the subscribed ruleset comes with rule actions to > provide protection, and instant threat updates. > > Are my options correct? > > Advise please. > > PS: I am new to this mailing list. > > Peter Lyons > > _______________________________________________ > Snort-users mailing list > [email protected] > Go to this URL to change user options or unsubscribe: > https://lists.snort.org/mailman/listinfo/snort-users > > To unsubscribe, send an email to: > [email protected] > > Please visit http://blog.snort.org to stay current on all the > latest Snort news! > > Please follow these rules: > https://snort.org/faq/what-is-the-mailing-list-etiquette > > > _______________________________________________ > Snort-users mailing list > [email protected] > Go to this URL to change user options or unsubscribe: > https://lists.snort.org/mailman/listinfo/snort-users > > To unsubscribe, send an email to: > [email protected] > > Please visithttp://blog.snort.org to stay current on all the latest Snort news! > > Please follow these rules:https://snort.org/faq/what-is-the-mailing-list-etiquette --------------mN4VI0JBRCYVsevradoIvs0X Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <p>Hi everyone,<br> <br> I wanted to share a real-world "beginner scenario" post-mortem that happened in my environment today, which perfectly aligns with Michael's advice on testing and hardware dependencies.<br> <br> I recently tried to deploy pfSense-pkg-snort (Snort 2.9.x) on a pfSense CE 2.8.1 box (FreeBSD 15-CURRENT base). Upon a clean installation with a restored ruleset config, the entire network collapsed instantly, and the local console became completely unresponsive, flooded with the following loop:<br> <br> "netmap_transmit [xxxx] re1 drop mbuf that needs checksum offload"<br> <br> What I learned the hard way:<br> 1. Hardware Matters: The firewall was running on Realtek PCIe GbE chips (re driver). The combination of Snort trying to hook into Netmap while Hardware Checksum Offloading, TSO, and LRO were still active globally caused a fatal buffer conflict.<br> 2. The Crash: Netmap dropped every single packet before it hit the OS stack because the Realtek hardware was passing segmented/checksummed packets that the DAQ engine couldn't parse.<br> 3. The Fix: I had to drop to the physical shell, run 'killall -9 snort', flush the 'snort2c' firewall table, and completely purge the package via 'pkg delete'. <br> <br> As Michael perfectly stated, you cannot just drop a premium ruleset out-of-the-box and flip the block switch. In the pfSense/FreeBSD ecosystem, running Snort/Suricata in Inline Mode (Netmap) on Realtek hardware without strictly disabling all hardware offloading beforehand is a recipe for a network-wide outage. <br> <br> We are now migrating the box to a dedicated Intel I350-T4 quad-port NIC to handle the multi-queue and Netmap requirements properly before attempting IPS again.<br> <br> Hope this helps any other beginners troubleshooting console freezes with Netmap and 're' drivers!<br> <br> Best regards,<br> Jarlei</p> <div class="moz-cite-prefix">Em 22/06/2026 13:35, Michael Steele via Snort-users escreveu:<br> </div> <blockquote type="cite" cite="mid:[email protected]"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style>@scope { @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;}@font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;}@font-face {font-family:Aptos;}@font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:12.0pt; font-family:"Aptos",sans-serif;}a:link, span.MsoHyperlink {mso-style-priority:99; color:#467886; text-decoration:underline;}span.EmailStyle20 {mso-style-type:personal-reply; font-family:"Aptos",sans-serif; color:windowtext;}.MsoChpDefault {mso-style-type:export-only; font-size:10.0pt; mso-ligatures:none;}@page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;}div.WordSection1 {page:WordSection1;}ol {margin-bottom:0in;}ul {margin-bottom:0in;} }</style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext="edit" spidmax="1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext="edit"> <o:idmap v:ext="edit" data="1" /> </o:shapelayout></xml><![endif]--> <div class="WordSection1"> <p class="MsoNormal">There is no way to download a pre-packaged, out-of-the-box ruleset tailored perfectly to a specific environment right from the start.<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal">While the Talos Subscriber ruleset gives you rapid, premium threat updates, even those rules default primarily to alert actions. This is intentional; if a ruleset dropped traffic by default, it would instantly break legitimate services on a home network the moment a false positive triggered.<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal">PulledPork is exactly the tool you need to change this behavior, but its base policies (Connectivity, Balanced, and Security) are only the starting point. To move from passive alerts to active blocking (drop actions), you need to configure PulledPork to rewrite the rule states for you.<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal">Building a custom ruleset that matches your specific network profile will take a little work, but here is the general approach to get you started:<o:p></o:p></p> <p class="MsoNormal"><b><o:p> </o:p></b></p> <p class="MsoNormal"><b>1. Enable Inline Dropping in Snort<o:p></o:p></b></p> <p class="MsoNormal">First, make sure Snort is actually configured to drop traffic. If Snort isn't running in inline mode (using DAQ modules like afpacket or nfq), changing the rules to drop won't do anything—it will still only log an alert. you need to ensure your execution mode supports blocking.<o:p></o:p></p> <p class="MsoNormal"><b><o:p> </o:p></b></p> <p class="MsoNormal"><b>2. Leverage PulledPork's Modification Files<o:p></o:p></b></p> <p class="MsoNormal">Instead of editing the massive ruleset manually every day (which gets overwritten on every update), you use PulledPork’s built-in state modification files: dropsid.conf, enablesid.conf, and disablesid.conf.<o:p></o:p></p> <ul style="margin-top:0in" type="disc"> <li class="MsoNormal" style="mso-list:l0 level1 lfo1"><b>dropsid.conf</b>: You can add specific Signature IDs (SIDs) or entire rule categories here. PulledPork will automatically change the action from alert to drop every time it downloads a new update.<o:p></o:p></li> <li class="MsoNormal" style="mso-list:l0 level1 lfo1"><b>disablesid.conf</b>: Use this to turn off noisy or irrelevant rules (like specific server vulnerabilities if you aren't running those servers at home) to reduce overhead and false positives.<o:p></o:p></li> </ul> <p class="MsoNormal"><b><o:p> </o:p></b></p> <p class="MsoNormal"><b>3. Start Small and Tune<o:p></o:p></b></p> <p class="MsoNormal">Start by using dropsid.conf on highly reliable, high-severity categories (like known malware command-and-control communication or active exploits). Watch your logs closely for a week to catch false positives before expanding your drop list.<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal">Tailoring a ruleset is an iterative process, but utilizing PulledPork to manage the rule modifications is the standard, efficient way to handle it.<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <div> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual">WINSNORT.com Management…<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual">--<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual">******************** Established ~ 2003 **********************<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual">* FREE Windows Intrusion Detection System (WinIDS) Tutorials *<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual">* ~~ FREE Windows Support Forums ~~ *<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual">* Visit @ <a class="moz-txt-link-freetext" href="http://winsnort.com">http://winsnort.com</a> *<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual">* Snort: Open Source Network IDS - <a class="moz-txt-link-freetext" href="http://snort.org">http://snort.org</a> *<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual">**************************************************************<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual">Best regards,<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";mso-ligatures:standardcontextual">Michael...<o:p></o:p></span></p> </div> <p class="MsoNormal"><o:p> </o:p></p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> <p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Snort-users <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a> <b>On Behalf Of </b>Jonathan Lee via Snort-users<br> <b>Sent:</b> Thursday, June 18, 2026 12:07 PM<br> <b>To:</b> Peter Lyons <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a><br> <b>Cc:</b> <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> <b>Subject:</b> Re: [Snort-users] Ruleset advice for beginners<o:p></o:p></span></p> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal">You have to set block on alert and inline mode or legacy mode <o:p></o:p></p> <div> <p class="MsoNormal">Sent from my iPhone<o:p></o:p></p> </div> <div> <p class="MsoNormal"><br> <br> <o:p></o:p></p> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <p class="MsoNormal" style="margin-bottom:12.0pt">On Jun 18, 2026, at 08:50, Peter Lyons via Snort-users <<a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a>> wrote:<o:p></o:p></p> </blockquote> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <div> <p class="MsoNormal"><span style="font-family:"Tahoma",sans-serif"></span> <o:p></o:p></p> <p style="margin-bottom:0in">About a year ago I installed snort3 and pulledpork on ubuntu 24.04 to provide better protection on my home network.<o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">I registered and used the LightSPD_ruleset, rule_mode=simple, ips_policy=balanced<o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">Got it all working, and auto updating the LightSPD ruleset everyday.<o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">At the start, I was checking the log $ tail -f /var/snort/alert_json.txt to see if it was working.<o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">So I felt very happy and secure.<o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">Then the other day I checked the log file a bit more and noticed the log file only had <b>alert warnings</b> and no rule actions like block or drop etc.<o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">So then I checked the LightSPD_ruleset and noticed that by default the rule actions are all set to <b>alert warnings.</b><o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">Which means I have to monitor the log file and customize the rules myself.<o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">While I’d call myself a linux enthusiast, I don’t have the expertise to do that.<o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in"><b>Is there a way to get a rule set suitable for a home network?</b><o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">I’m thinking there might be a community rule set suitable or pay for a subscribed Talos ruleset.<o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">I’m assuming the subscribed ruleset comes with rule actions to provide protection, and instant threat updates.<o:p></o:p></p> <p style="margin-bottom:0in">Are my options correct? <o:p></o:p></p> <p style="margin-bottom:0in"><o:p> </o:p></p> <p style="margin-bottom:0in">Advise please.<o:p></o:p></p> <p>PS: I am new to this mailing list.<o:p></o:p></p> <p>Peter Lyons<o:p></o:p></p> <p><o:p> </o:p></p> <p class="MsoNormal">_______________________________________________<br> Snort-users mailing list<br> <a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a><br> Go to this URL to change user options or unsubscribe:<br> <a href="https://lists.snort.org/mailman/listinfo/snort-users" moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.snort.org/mailman/listinfo/snort-users</a><br> <br> To unsubscribe, send an email to:<br> <a href="mailto:[email protected]" moz-do-not-send="true" class="moz-txt-link-freetext">[email protected]</a><br> <br> Please visit <a href="http://blog.snort.org" moz-do-not-send="true" class="moz-txt-link-freetext">http://blog.snort.org</a> to stay current on all the latest Snort news!<br> <br> Please follow these rules: <a href="https://snort.org/faq/what-is-the-mailing-list-etiquette" moz-do-not-send="true" class="moz-txt-link-freetext">https://snort.org/faq/what-is-the-mailing-list-etiquette</a><o:p></o:p></p> </div> </blockquote> </div> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <pre wrap="" class="moz-quote-pre">_______________________________________________ Snort-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> Go to this URL to change user options or unsubscribe: <a class="moz-txt-link-freetext" href="https://lists.snort.org/mailman/listinfo/snort-users">https://lists.snort.org/mailman/listinfo/snort-users</a> To unsubscribe, send an email to: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> Please visit <a class="moz-txt-link-freetext" href="http://blog.snort.org">http://blog.snort.org</a> to stay current on all the latest Snort news! Please follow these rules: <a class="moz-txt-link-freetext" href="https://snort.org/faq/what-is-the-mailing-list-etiquette">https://snort.org/faq/what-is-the-mailing-list-etiquette</a> </pre> </blockquote> </body> </html> --------------mN4VI0JBRCYVsevradoIvs0X-- --===============1407433239140866950== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============1407433239140866950==--