Pfelk: pfSense, Suricata - Dashboard not working

[squirrelboot]

Describe the bug
My Suricata Dashboard is missing its data.
It says 'Infinite extent for field "y1": [Infinity, -Infinity]
[Photo](https://i.imgur.com/ucaEYJN.png).

Here is how I set up Suricata in pfSense:
Services - Suricata - WAN Interface Settings.pdf

Alerts are working in pfsense after setup:
https://i.imgur.com/AvQpIXP.png

Firewall System (please complete the following information):

• pfSense
• v2.5.0.r.20210211.0300

Operating System (please complete the following information):

Linux 4.19.0-14-amd64 x86_64

PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian

Installation method (manual, ansible-playbook, docker, script):
script installation method

Elasticsearch, Logstash, Kibana (please complete the following information):
elasticsearch 7.11.0 amd64 Distributed RESTful search engine built for the cloud
logstash 1:7.11.0-1 amd64 An extensible logging pipeline
kibana 7.11.0 amd64 Explore and visualize your Elasticsearch data

Elasticsearch, Logstash, Kibana logs:
https://pastebin.com/JwJYpF7W

[a3ilson]

@squirrelboot - You'll need to follow these instructions which are referenced on the Finish Setup page.

This is a workaround to send the logs as they often exceed 1024 characters resulting in pfSense truncating the message rendering them inoperable for logstash. Hopefully, pfSense v2.5.0 fixes this issue as the remote logging was revamped.

Reference: Issue #111

[squirrelboot]

I will use the instructions you reference, thank you.

I am using v2.5.0 :)

[a3ilson]

Awe...

Well you could do some testing for us (I do not use pfSense).

pfSense 2.5.0 supports logging formats BSD/Syslog (RFC 3164 and RFC 5424). Currently pfelk will only parse/enrich the BSD or RFC 3164. You could utilize the syslog 5424 which will not fully parse (at the moment - reference #246) but I would be curious if it will accept Suricata messages.

Give This a Try:
Set the output to syslog (RFC 5424) as the RFC does not denote a maximum message length. Unlike RFC 3164 which specifies the max length to no greater than 1024. Furthermore, RFC 5424 requires acceptance of at least 2048 messages lengths. Basically, the RFC 5424 output should work without you having to install syslog-ng etc...

The messages will parse out and get received/logged but they will not parse out nicely (enriched). Once you have received some suricata messages, check and see if the message was received in it's entirety. If this works, I can easily revise the filter to work with the BSD/RFC 5424 and once 2.5.0 is released, we can amend/update the instructions (make it easier)

Let know if you need any help with this...

[squirrelboot]

Hi! Thank you for the help Andrew.

So I first tried what you suggested re: suricata/pfsense/syslog-ng..
That broke snort even.

I reverted to a snapshot. Undoing the changes there.

I then tried switching to syslog as you suggested.
Remembering to re-enable in pfsense suricata..
Send Alerts to System Log - Suricata will send Alerts from this interface to the firewall's system log.
Restarted that service.

It still just says
Infinite extent for field "y1": [Infinity, -Infinity]

[a3ilson]

Correct!

We'll need to troubleshoot it. The logs are likely being sent but not parsed.

See if they are logged by going to Kibana>>Discover

[squirrelboot]

Alright, after I did those things, now nothing is coming in?

[squirrelboot]

I use discord, telegram, etc. too if that helps re: communication

[a3ilson]

https://discord.gg/BJmP7jXD

[squirrelboot]

If I run:
sudo tcpdump -nni ens32 port 5140 -s 0 -AA -vv

I am able to see traffic coming in

[a3ilson]

Sweet! Run it again with these flags:

tcpdump -vvv -A -i any port 5140 > pfblocker.tcp

This will output to a file...I'll need to obtain the message syntax as it likely isn't being parsed preventing it from being logged.

Once the GROK pattern is revised, we can check to see if suricata works - should be able to check it with the dump, if captured too.

It'll take a little refinement for the GROK pattern....but if you're willing to let it run and report any issues, I'd like to get this built and ready for the release.

[a3ilson]

246 - This issue is specific to pfsense 2.5.0 - troubleshooting to check feasibility of sending suricata logs via syslog (RFC 5424) which was previously problematic due to the pfsense adhering to the RFC 3164 limitation of 1024 characters being sent with RFC 3164.

[a3ilson]

Closing this issue as it is related to #246 and will be addressed once pfSense 2.5.0 is released.