pfSense » pfSense Packages

Steve Wheeler wrote:

Snort will fail to start if enabled on a PPPoE interfaces using the new if_pppoe module:

[...]

This appears to be because the interface returns encapsulated traffic when capturing on it and Snort doesn't currently decode that.

Tested in 2.8 with Snort package 4.1.6_25

See: https://forum.netgate.com/post/1216659

This also impacts Suricata on 25.07 and if_pppoe as well - if Suricata is left running on the WAN PPPoE interface, it will log to suricata.log for the PPPoE interface and fill up the filesystem. My log location is at /var/log/suricata/suricata_pppoe0862/suricata.log and was 19GB when firewall traffic degraded.

Log file was filled with the following, logged multiple times per second:
Error: pcap: datalink type 51 not yet supported