0000581: enhance snort 2.8 compatibility - PacketFence

(0001094)
maikel (reporter)
2009-02-10 13:22

Isnt packetfence already running snort 2.8 since 1.7(even 1.6.2) I runn 1.7 on a system with snort 2.8 already for more then a year without problems, except the custom pfdetect tail

(0001095)
user4
2009-02-10 13:45

I am trying to use Snort 2.8 which is throwing â€˜Cannot check flow connection for non-TCP trafficâ€™ in the event logs. I looked up the reason for this error and 99% of the time the solution was an old snort.conf file.

Josh Moon

(0001096)
user4
2009-02-10 13:46

The issue seems to go away when we use the settings in the default snort configuration file shipped with snort 2.8

(0001136)
maikel (reporter)
2009-03-12 16:56

Actually thats because of the flow preprocessor. It should be replaced by stream5 for non tcp traffic.

(0001405)
obilodeau (reporter)
2009-11-19 14:41

fixed in 1.8 branch: http://mtn.inverse.ca/revision/info/4035cca68326bfae23143f7b9eb036233d3bf6fa [^]
will be ported to 1.9

Issue History
Date Modified	Username	Field	Change
2009-02-10 12:34	user4	New Issue
2009-02-10 13:22	maikel	Note Added: 0001094
2009-02-10 13:45	user4	Note Added: 0001095
2009-02-10 13:46	user4	Note Added: 0001096
2009-02-10 13:46	user4	Summary	snort 2.8 compatibility => enhance snort 2.8 compatibility
2009-03-03 15:22	user4	Category	1.8.1 => 1.8.2
2009-03-12 16:56	maikel	Note Added: 0001136
2009-04-13 13:34	user4	Category	1.8.2 => 1.8.3
2009-06-05 08:53	user4	Project	PacketFence => PacketFence 1.9
2009-06-08 08:51	user4	Relationship added	related to 0000716
2009-11-19 11:44	obilodeau	Status	new => assigned
2009-11-19 11:44	obilodeau	Assigned To	=> obilodeau
2009-11-19 14:41	obilodeau	Note Added: 0001405
2009-11-19 14:41	obilodeau	Status	assigned => resolved
2009-11-19 14:41	obilodeau	Resolution	open => fixed
2010-04-15 17:43	obilodeau	Project	PacketFence 1.9 => PacketFence
2011-01-26 15:43	obilodeau	Status	resolved => closed

Notes
(0001094) maikel (reporter) 2009-02-10 13:22	Isnt packetfence already running snort 2.8 since 1.7(even 1.6.2) I runn 1.7 on a system with snort 2.8 already for more then a year without problems, except the custom pfdetect tail

(0001095) user4 2009-02-10 13:45	I am trying to use Snort 2.8 which is throwing â€˜Cannot check flow connection for non-TCP trafficâ€™ in the event logs. I looked up the reason for this error and 99% of the time the solution was an old snort.conf file. Josh Moon

(0001096) user4 2009-02-10 13:46	The issue seems to go away when we use the settings in the default snort configuration file shipped with snort 2.8

(0001136) maikel (reporter) 2009-03-12 16:56	Actually thats because of the flow preprocessor. It should be replaced by stream5 for non tcp traffic.

(0001405) obilodeau (reporter) 2009-11-19 14:41	fixed in 1.8 branch: http://mtn.inverse.ca/revision/info/4035cca68326bfae23143f7b9eb036233d3bf6fa [^] will be ported to 1.9