Snort: Incorrect Initial Configuration Leading to Failure

NethSecurity
1

When IPS (Snort) is enabled for the first time in the Web UI, if the number of CPU cores (including Hyper-Threading/HT) exceeds 16 (a common occurrence on modern CPUs), the resulting configuration is incorrect, which prevents Snort from functioning.

The core problem is an incorrectly configured number of queues.

For example, a machine with 16 physical cores and HT enabled presents 32 logical processors (threads) to the operating system.

The generated configuration file (/etc/config/snort) contains the following error:

config nfq 'nfq'
        option queue_count '32'
...
        option thread_count '32'
...

This configuration triggers the following error upon manual startup service snort restart and check snort-mgr check:

ERROR: In option queue_count=‘32’, must be 1 <= x <= 16 Errors during generation of snort config

But the IPS/Snort is silently broken and the Web UI indicates, that everything is fine,

2 Likes
2

Solution: Manually edit the number of queues (e.g., set queue_count to 16) and restart the Snort service.

3

This is the first time we got this reported. The changes you’ve made are being overridden every time the snort config is being saved!

A bug report should be filled, to keep track of it, since you’ve got the gist of it would you kindly do it?

4

Maybe relevant: config: set queue count limit to 16 (#34) · NethServer/nethserver-suricata@afdb6e5 · GitHub

5

Filed a bug report:

2 Likes