pfSense » pfSense Packages

perhaps the same behavior with barnyard2

This behavior will impact Barnyard2 and also Suricata (and Barnyard2 in a Suricata setup).

This behavior is also going to be present in all prior versions of pfSense, including the current RELEASE branch.

Corresponded with Jim Pingle about this issue. There is no elegant or simple way for notifying a running package (An IDS package in this case) that an interface is being removed or unassigned within the pfSense GUI. It is probably better to expect the user to understand the potential ramifications of removing or unassigning an interface that may also be in active use by a package.

I will alter the package GUI code to detect when an assigned pfSense interface is "missing" and take appropriate action such as disabling the interface in the IDS GUI and not starting that interface on subsequent package start commands. The user will be notified within the GUI (on both the INTERFACES and INTERFACE SETTINGS tabs) using visual clues that a formerly assigned IDS interface is now not present in pfSense. The user will have the ability to either delete the IDS interface instance completely, or reassign it to a new existing pfSense interface.

This issue can be marked as RESOLVED. Pull request 678 has been submitted to teh pfSense-2.5-DEVEL branch here: https://github.com/pfsense/FreeBSD-ports/pull/678.

The Snort GUI now recognizes when the pfSense physical interface that had been assigned to a configured Snort instance is missing. It will no longer generate a configuration directory for the missing interface nor will it attempt to start Snort on that interface. The Snort instance will show in the GUI on the INTERFACES tab as "disabled", and the user has the ability to either delete that Snort configuration instance or assign it to a different existing physical interface.

There is still the possibility that if the physical interface is deleted in the pfSense GUI while an active Snort instance is running on that interface, the user will be left with a zombie Snort process. The only way to stop that process would be using the kill command via a CLI session. There is no existing elegant method by which pfSense can notify a running package process daemon that an interface change is happening.