Large rule sets in Snort on pfSense cause PHP memory crash

Ran into an issue in Snort on pfSense where the memory limit specified in /usr/local/pkg/snort/ is insufficient and the service will crash shortly after launch.

The part that needs to be increased is bolded.

* part of pfSense (
* Copyright (c) 2006-2023 Rubicon Communications, LLC (Netgate)
* Copyright (c) 2009-2010 Robert Zelaya
* Copyright (c) 2013-2022 Bill Meeks
* All rights reserved.
* Licensed under the Apache License, Version 2.0 (the “License”);
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an “AS IS” BASIS,
* See the License for the specific language governing permissions and
* limitations under the License.

require_once(“”); // Need this to get RCFILEPREFIX definition

// Snort GUI needs some extra PHP memory space to manipulate large rules arrays
ini_set(“memory_limit”, “4096M”);

// Explicitly declare this as global so it works through function call includes
global $g, $rebuild_rules;

/* Rebuild Rules Flag — if “true”, rebuild enforcing rules and flowbit-rules files */
$rebuild_rules = false;


If that limit is too low, Snort will produce this error when it’s loading:

[25-Jan-2023 20:25:20 America/New_York] PHP Fatal error: Allowed memory size of 402653184 bytes exhausted (tried to allocate 12288 bytes) in /usr/local/pkg/snort/ on line 1093

The file is overwritten each time the pkg is updated so you have to make this change each time.

N.B. The install doesn’t complete due to memory exhaustion, you can prevent this by going into Snort and removing a character from your oinkcode. This will prevent the rule set from being downloaded and allow the install to complete since it’s the enumeration of rules that fills the memory.

Thoughts on a Monday

It might be time to find new hosting. The site is so much slower than it used to be.


Edit: Moments after posting, I get this. We’ll see if things improve.

Should We Keep Wearing Masks?

I found this interesting.

APRIL 2, 2021 10:42 AM EDT


Riding the New York City subway during cold and flu season used to test your stomach. The woman next to you was coughing. The guy behind her was sneezing. Somebody was always fishing for a tissue.

That’s a distant memory now. The subway is far emptier, for one thing—and with the riders onboard almost universally wearing masks, the chorus of sniffles and coughs has been silenced. During the pandemic, the need for that policy is clear. But should the masks stay even after COVID-19 is gone?

Before vaccines began rolling out to the general public, masks were among the only tools available for containing SARS-CoV-2, the virus that causes COVID-19. And they seem to have done their job. A mask both provides the wearer a physical barrier against germs, and prevents them from exhaling potentially infectious droplets into the atmosphere, ideally cutting down on the amount of circulating virus that can infect others, the U.S. Centers for Disease Control and Prevention (CDC) says. Areas that implemented mask mandates saw statistically significant declines in COVID-19 case counts and deaths within 20 days, according to agency data.

Masks are “minimally invasive, safe, cheap, effective,” says Raina MacIntyre, a professor of global biosecurity at Australia’s University of New South Wales who has studied face masks since long before the pandemic.

They’re also controversial. While masks clearly have more benefits than drawbacks during the pandemic, their post-pandemic future is less certain. Dr. John Conly, an infectious disease physician at Canada’s University of Calgary who has also studied masks, says he wouldn’t support masking after the pandemic ends, given downsides like discomfort and difficulty communicating.

The U.S. public seems likely to agree. With the steady thrum of anti-mask sentiment in the U.S., it’s highly unlikely that they will continue to be a ubiquitous sight after the pandemic ends. But there are certain settings—while riding a packed subway, for example, or when visiting a loved one in the hospital—where an extra layer of protection might make sense even after the pandemic era. Like COVID-19 itself, masks likely won’t be our constant reality, but they may not fade away completely, either.

Before the world knew about COVID-19, masking was already common in many Asian countries. Particularly after the SARS outbreak in the early 2000s, face masks became a regular sight in Hong Kong, Japan and other parts of Eastern Asia, where people often wore them to protect themselves and others during cold and flu season. So when COVID-19 hit, people in those countries generally were very much willing to mask up.

In the U.S., the sell has been a bit harder. Most people rarely, if ever, masked prior to March 2020. Health officials actually discouraged the public from doing so in the early months of the pandemic, citing uncertain data about masks’ efficacy against SARS-CoV-2 and the need to preserve scarce personal protective equipment for health care workers. Even after health officials reversed course and began encouraging fabric masks in public, former President Donald Trump repeatedly downplayed masks’ importance.

As the pandemic went on, scientific consensus shifted to be strongly in favor of masks, and many states and cities mandated their use in public. And while masks are certainly not perfect—some particles can still pass through—the data suggest that they’ve helped curtail the spread not just of COVID-19, but other diseases, too.

During the 2019-2020 flu season, at least 24,000 people in the U.S. died from the influenza virus. It’s too soon to know exactly how many people will die from the flu during the 2020-2021 season, but it will almost surely be a much lower number. Fewer than 500 people in the U.S.—and just one child—had died from the flu as of April 1, according to CDC data. Traditional flu season won’t end until May, but flu death rates would have to increase astronomically to match last year’s full season toll.

Masks aren’t solely responsible for that precipitous drop. More people got vaccinated against the flu during this season compared to usual ones, as the CDC issued desperate warnings to stave off a “twindemic” of influenza and COVID-19. Social distancing and remote work and school kept people away from strangers’ germs. And many people have been hyper-conscious of hand-washing and other hygiene during the pandemic.

Masks are only one piece of that “bundled approach,” and it’s hard to tease out exactly how much of a role they played, says Conly, who co-authored a November 2020 Cochrane Review analysis of respiratory disease prevention tools. After analyzing nine prior studies on non-N95 medical masks, Conly and his colleagues found little evidence to suggest they’d prevent the wearer from catching influenza or a flu-like illness. A controversial and much-publicized March 2021 study out of Denmark also concluded that surgical masks did not significantly reduce the wearer’s chances of contracting COVID-19.

But there are two issues at play when it comes to masks. One is whether they protect the wearer from disease. All along, experts have known cloth and surgical masks don’t block all pathogens. They likely provide some protection for the wearer, but they are not an impenetrable barrier, as the above two studies confirm.

The second issue, which is harder to measure, is what’s called “source control.” Masks do seem to be quite good at trapping many of the respiratory droplets exhaled by the wearer, preventing them from getting out into the atmosphere where they could infect others. If everyone wears a mask, there’s simply less virus floating around, which theoretically translates to fewer sicknesses.

Reducing the amount of virus in shared environments is a crucial aspect of pandemic response. And because COVID-19 can be spread asymptomatically, meaning anyone could be unknowingly carrying the virus and passing it to others, everyone should be doing what they can to avoid spreading it.

The equation is a little more complex in the post-pandemic future. Once we are not living with the constant threat of a dangerous disease, the downsides of masking—annoyance, stunted communication, acne, potentially even small amounts of microplastic inhalation—may outweigh the source control benefits, Conly says. “The balance of the evidence would suggest this is not a good thing to do,” Conly says.

MacIntyre disagrees. It likely wouldn’t make sense to wear a mask 24/7 once COVID-19 is contained, but she says masking is easy and safe enough to justify it in high-impact settings, like public transit, long-term care facilities and hospitals.

Once the pandemic ends, mask wearing wouldn’t even have to be mandatory or universal to make a difference. Right now, with COVID-19 spreading as readily as it, each person who refuses to wear a mask in public is potentially endangering those around them. But in a post-COVID future, each person who chooses to wear a mask would be doing a little something extra to keep themselves and those around them healthy, MacIntyre says. It would be particularly logical for people to wear masks during cold and flu season, when there’s quite a bit of disease going around.

That’s assuming cold and flu seasons would continue to exist in their current forms, however, which may not be guaranteed if masks stick around. Australia is an instructive example. Rates of the childhood disease respiratory syncytial virus (RSV) plummeted there last winter—usually the dominant season for RSV—when most people were staying home and wearing masks. But as the country got COVID-19 under control and reopened for its summer season, Australia experienced an off-season surge of RSV even beyond what would be expected during a normal winter.

The surge may have been the cost of an earlier RSV-free season, says Dr. Richard Malley, an infectious diseases physician at Boston Children’s Hospital. Human immunity is layered. While exposure to a virus or bacteria can get someone sick, it also often helps prepare their immune system for its next brush with that pathogen. (Many vaccines work in roughly the same way: by introducing a weakened virus or bacteria into the body, so it knows how to respond if it encounters the real thing.)

A normal RSV season would get plenty of people sick, but it would also build up community-wide immunity in preparation for next year’s season. Without that cyclical exposure, immunity likely began to wane over the winter months—so when people encountered RSV in the summer, their bodies weren’t prepared for it and they got sick, Malley explains.

Year-round masking could also change disease patterns in the U.S., Malley says. Instead of defined disease seasons, viruses could circulate and spread at more uniform levels all year round. That could turn out to be a good thing, if it meant less disease overall. But it’s not entirely clear what would happen if continuous mask-wearing reduced exposure to routine pathogens enough that some kids were not exposed to common viruses or bacteria until later in life. For certain diseases that strike kids harder than adults, that delay could be beneficial, even lifesaving. But it could also alter the way kids naturally build immunity to certain pathogens over time.

“That would be, in a way, a national experiment,” Malley says. “In the case of coronavirus, because of the impact this virus has had on our society, it goes without saying that social distancing and masking measures are absolutely the way to go. But for the long term, that’s a much more difficult question.”

At this point, though, Malley doubts most people would even be willing to wear masks frequently without the immediate threat of a pandemic and the mask mandates that came with it. “We can’t even get [some] people to do it in the midst of the pandemic,” Malley notes. “They’ve been lifesaving, but they do symbolize, to some extent, the restrictions that have been placed on all of us.”

There are some lessons from the pandemic that may catch on, even if masks once again fade to the provenance of Halloween costumes. Never before has the American public been so attuned to how diseases spread, and the potential consequences when they do. Malley hopes that consciousness, and conscientiousness, will outlast the pandemic, encouraging people to keep washing their hands, getting vaccines and staying home from work or school even if they think they only have “the sniffles.”

“Something we’ve been telling people for years,” he says, “may finally sink in.”

Load more