pfSense

Current Base System: 2.5.0.a.20201005.1047

Problem: After update, the traffic graphic stopped on interface with snort configured in mode "inline IPS". IF disable snort or alter snort to "legacy mode" the traffic graphic on interface work normally

In the dashboard and Status > Traffic Graph

I use Vmware as network interface

I've been using pfsense 2.5 for a month now, worked normally. only after 2020-10-02 updates the traffic graphic stopped

Edivan Carneiro de castro wrote:

I've been using pfsense 2.5 for a month now, worked normally. only after 2020-10-02 updates the traffic graphic stopped

Do you mean you were previously using Snort on pfSense-2.5 with Inline IPS Mode enabled? Or were you using Legacy Mode and switched to Inline IPS Mode after the last Snort package update?

One thing that changed in the latest Snort package update was a new version of the DAQ library was added (version 2.2.2_2). This new DAQ update implements the very latest netmap API 14 used in FreeBSD-12/STABLE. Also, FreeBSD-12 implements netmap functionality as part of the iflib framework. I believe continual "tweaking" is going on there with repect to various NIC drivers and even the netmap device itself.

So the first critical data point for troubleshooting is to determine if you were successfully using Inline IPS Mode with Snort on pfSense-2.5 prior to October 2nd (and also successfully using Traffic Graph). In the past, those two elements (netmap operation with Inline IPS Mode and Traffic Graph) have not been compatible.