All Apps and Add-ons

Connection error after upgrading to sourcefire


After upgrading sourcefire to version from 5.4.1 the script fails to connect and retrieve the logs. Analyzing the packets we can see that there is a error in the SSL handshake. The script requests come in TLS1.0 and the server is replaying with TLS1.2.

Here is the SSL connection in the script.

verbose("Connecting to $cli_opt->{server} port $cli_opt->{port}");
my $client = new IO::Socket::SSL( Domain        => $cli_opt->{domain},
                                  PeerAddr      => $cli_opt->{server},
                                  PeerPort      => $cli_opt->{port},
                                  Proto         => 'tcp',
                                  SSL_version   => 'TLSv12',
                                  SSL_use_cert  => 1,
                                  SSL_cert_file => $crtfile,
                                  SSL_key_file  => $keyfile,
                                  SSL_verify_mode => 'SSL_VERIFY_NONE')
    or die("Can't connect to $cli_opt->{server} port $cli_opt->{port}: ".IO::Socket::SSL::errstr()."\n\n");

Is there another way of retrieving sourcefire logs into splunk? Or how can the script be edited so that the sourcefire server accepts the connection.

We use "Splunk Add-on for Cisco FireSIGHT" which then needs the "eStreamer for splunk" app for the data collection.

0 Karma


I may have a fix for you. We have a modified version of the app that forces TLS v1 upon connection to the FMC. Please mail me at and I can email you the new app. I'll try to post it to Splunk apps today too.

New Member

No IP addresses were changed during the upgrade. We regenerated the certificate and that's also not working

0 Karma


Has the IP address of either side of the connection changed during the upgrade?

Additionally, have you attempted creating a new client entry in the FMC and downloading the newly created certificate?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!