oinkmaster-users Mailing List for oinkmaster
Brought to you by:
andreas_o
Menu
▾
▴
oinkmaster-users — General Oinkmaster discussion
You can subscribe to this list here.
| 2003 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
(1) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2004 |
Jan
|
Feb
(1) |
Mar
(3) |
Apr
(2) |
May
(1) |
Jun
(5) |
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
| 2005 |
Jan
(2) |
Feb
|
Mar
(1) |
Apr
(10) |
May
|
Jun
|
Jul
|
Aug
(3) |
Sep
(7) |
Oct
|
Nov
|
Dec
|
| 2006 |
Jan
|
Feb
(5) |
Mar
(2) |
Apr
(4) |
May
(2) |
Jun
(2) |
Jul
(3) |
Aug
(1) |
Sep
|
Oct
(2) |
Nov
|
Dec
|
| 2008 |
Jan
|
Feb
(2) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
(2) |
Oct
|
Nov
|
Dec
|
| 2009 |
Jan
|
Feb
(1) |
Mar
|
Apr
|
May
(1) |
Jun
(14) |
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
| 2010 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(5) |
Aug
|
Sep
(2) |
Oct
|
Nov
|
Dec
|
| 2011 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(2) |
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2013 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
(1) |
|
From: Alexander G. <ale...@gm...> - 2013-12-02 09:49:49
|
Hi all!
Is it possible add to package simple Makefile just for installing. It be useful for automatization. Like this:
.PHONY: install
INSTALL_DIR = /usr/bin/install -d -m 755
INSTALL_PROGRAM = /usr/bin/install -m 555
INSTALL_DATA = /usr/bin/install -m 644
install:
$(INSTALL_DIR) "$(DESTDIR)/etc"
$(INSTALL_DATA) oinkmaster.conf "$(DESTDIR)/etc"
$(INSTALL_DIR) "$(DESTDIR)/man1"
$(INSTALL_DATA) oinkmaster.1 "$(DESTDIR)/man1"
$(INSTALL_DIR) "$(DESTDIR)/bin"
$(INSTALL_PROGRAM) oinkmaster.pl "$(DESTDIR)/bin"
Best regards,
Alexander Galato
|
|
From: JJC <cum...@gm...> - 2011-06-10 22:04:13
|
Try pulledpork: http://code.google.com/p/pulledpork/ JJC On Fri, Jun 10, 2011 at 3:54 PM, Greg Pangrazio <pan...@gm...> wrote: > I am looking for a good way to modify the snort rule set for IPS use. > I don't want to add drop to any alert rule. Has anyone used either > they priority or the rule meta data to create an oinkmaster rule for > this? > > Greg Pangrazio > > > ------------------------------------------------------------------------------ > EditLive Enterprise is the world's most technically advanced content > authoring tool. Experience the power of Track Changes, Inline Image > Editing and ensure content is compliant with Accessibility Checking. > http://p.sf.net/sfu/ephox-dev2dev > _______________________________________________ > Oinkmaster-users mailing list > Oin...@li... > https://lists.sourceforge.net/lists/listinfo/oinkmaster-users > |
|
From: Greg P. <pan...@gm...> - 2011-06-10 21:54:56
|
I am looking for a good way to modify the snort rule set for IPS use. I don't want to add drop to any alert rule. Has anyone used either they priority or the rule meta data to create an oinkmaster rule for this? Greg Pangrazio |
|
From: JJ C. <cum...@gm...> - 2010-09-02 20:32:47
|
This is not for oinkmaster, but the same steps should hold true.... Also, might consider upgrading... http://global-security.blogspot.com/2010/07/pulledpork-042-501-error-when.html Sent from the iRoad On Sep 2, 2010, at 13:53, Fábio Ferrão <fer...@gm...> wrote: > Dears, > > I'm using the oinkmaster for update snort rules, but I can't update the rules, because the follow erros show me. > > /usr/local/bin/oinkmaster -o /usr/local/etc/snort/rules/rules > Loading /usr/local/etc/oinkmaster.conf > Downloading file from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-2861.tar.gz... > /usr/local/bin/oinkmaster: Error: could not download from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-2861.tar.gz. Output from wget follows: > > http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-2861.tar.gzResolving www.snort.org... 68.177.102.20 > Connecting to www.snort.org|68.177.102.20|:80... connected. > HTTP request sent, awaiting response... 302 Found > Location: https://s3.amazonaws.com/snort.org/rules/20100803/snortrules-snapshot-2861.tar.gz?AWSAccessKeyId=AKIAJJSHU7YNPLE5MKOQ&Expires=1283454702&Signature=JMmfYLi%2FW5tLZptXRuKgRfsbjRs%3D [following] > --2010-09-02 16:11:12-- https://s3.amazonaws.com/snort.org/rules/20100803/snortrules-snapshot-2861.tar.gz?AWSAccessKeyId=AKIAJJSHU7YNPLE5MKOQ&Expires=1283454702&Signature=JMmfYLi%2FW5tLZptXRuKgRfsbjRs%3D > Resolving s3.amazonaws.com... 72.21.202.164 > Connecting to s3.amazonaws.com|72.21.202.164|:443... connected. > ERROR: cannot verify s3.amazonaws.com's certificate, issued by `/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)09/CN=VeriSign Class 3 Secure Server CA - G2': > Unable to locally verify the issuer's authority. > To connect to s3.amazonaws.com insecurely, use `--no-check-certificate'. > Unable to establish SSL connection. > > Oink, oink. Exiting... > > Can somebody tell me why the oinkmaster stopped, because it worked successfully? It didn't show errors of certificate checks. > > > > > -- > Fábio Ferrão > > "E conhecereis a verdade e a verdade vos libertará". João 8.32 > "And you will know the truth and the truth you will free". John 8.32 > ------------------------------------------------------------------------------ > This SF.net Dev2Dev email is sponsored by: > > Show off your parallel programming skills. > Enter the Intel(R) Threading Challenge 2010. > http://p.sf.net/sfu/intel-thread-sfd > _______________________________________________ > Oinkmaster-users mailing list > Oin...@li... > https://lists.sourceforge.net/lists/listinfo/oinkmaster-users |
|
From: Fábio F. <fer...@gm...> - 2010-09-02 19:53:53
|
Dears, I'm using the oinkmaster for update snort rules, but I can't update the rules, because the follow erros show me. */usr/local/bin/oinkmaster -o /usr/local/etc/snort/rules/rules* *Loading /usr/local/etc/oinkmaster.conf* *Downloading file from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-2861.tar.gz. .. * */usr/local/bin/oinkmaster: Error: could not download from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-2861.tar.gz. Output from wget follows:* * * * http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-2861.tar.gzResolvingwww.snort.org... 68.177.102.20 * *Connecting to www.snort.org|68.177.102.20|:80... connected.* *HTTP request sent, awaiting response... 302 Found* *Location: https://s3.amazonaws.com/snort.org/rules/20100803/snortrules-snapshot-2861.tar.gz?AWSAccessKeyId=AKIAJJSHU7YNPLE5MKOQ&Expires=1283454702&Signature=JMmfYLi%2FW5tLZptXRuKgRfsbjRs%3D[following] * *--2010-09-02 16:11:12-- https://s3.amazonaws.com/snort.org/rules/20100803/snortrules-snapshot-2861.tar.gz?AWSAccessKeyId=AKIAJJSHU7YNPLE5MKOQ&Expires=1283454702&Signature=JMmfYLi%2FW5tLZptXRuKgRfsbjRs%3D * *Resolving s3.amazonaws.com... 72.21.202.164* *Connecting to s3.amazonaws.com|72.21.202.164|:443... connected.* *ERROR: cannot verify s3.amazonaws.com's certificate, issued by `/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)09/CN=VeriSign Class 3 Secure Server CA - G2':* * Unable to locally verify the issuer's authority.* *To connect to s3.amazonaws.com insecurely, use `--no-check-certificate'.* *Unable to establish SSL connection.* * * *Oink, oink. Exiting...* Can somebody tell me why the oinkmaster stopped, because it worked successfully? It didn't show errors of certificate checks. -- Fábio Ferrão "E conhecereis a verdade e a verdade vos libertará". João 8.32 "And you will know the truth and the truth you will free". John 8.32 |
|
From: JJ C. <cum...@gm...> - 2010-07-13 22:12:44
|
U likely are missing some required perl modules, unfortunately I cannot troubleshoot as long as I'm on vacation, plus I won't use winders so, there is that! Sent from the iRoad On Jul 13, 2010, at 10:14, Alejandro Cabrera Obed <ac...@gm...> wrote: > Yes, I can download the snort rules from my web browser, using the > same proxy as used in oinkmaster. > > Since past June, oinkmaster download rules from s3.amazonaws.com:443 > and I think the problem is that ActivePerl can't manage HTTPS > downloads. > > Did you hear anything about this ??? > > Thanks again > > 2010/7/13 Russell Fulton <r.f...@au...>: >> >> On 14/07/2010, at 3:55 AM, Alejandro Cabrera Obed wrote: >> >>> Dear all, I'm contacting you because I can't see any solution in the >>> wwww....I've Oinkmaster 2.0 installed in my Windows 2003 Server >>> machine. I've have ActivePerl 5.12 installed and Oinkmaster 2.0, and >>> Snort 2.8.5.3. >>> >>> I set up a HTTP_PROXY environment variable as was required for Perl >>> installation. (HTTP_PROXY=http://10.4.1.10:8080). >>> >>> In oinkmaster.conf I've change the URL path to download the Snort >>> rules since last June according to the announcement in Snort page >>> about the new url including the oinkcode, it's OK because some days >>> ago it worked: >>> >>> url = http://www.snort.org/pub-bin/oinkmaster.cgi/*my_oinkcode*/snortrules-snapshot-2853.tar.gz >>> >>> Now I run the same script from a command shell (Windows), in the way: >>> >>> c:\oinkmaster-2.0\oinkmaster.pl -C c:\oinkmaster-2.0\oinkmaster.conf >>> -o "c:\snort\rules" >>> >>> And I've got the following error: >>> >>> oinkmaster.pl: Error: could not download from >>> http://www.snort.org/pub-bin/oinkmaster.cgi/*my_oinkcode*/snortrules-snapshot-2853.tar.gz: >>> 500 Can't connect to s3.amazonaws.com:443 (Bad hostname >>> 's3.amazonaws.com') >>> >> >> can you download from commandline or browser? This is unlikely to be an issue with oinkmaster, more likely something has changed in your netwrork set up. >> >> Russell >> >> > > > > -- > Alejandro Cabrera Obed > ac...@gm... > www.alejandrocabrera.com.ar > > ------------------------------------------------------------------------------ > This SF.net email is sponsored by Sprint > What will you do first with EVO, the first 4G phone? > Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first > _______________________________________________ > Oinkmaster-users mailing list > Oin...@li... > https://lists.sourceforge.net/lists/listinfo/oinkmaster-users |
|
From: Alejandro C. O. <ac...@gm...> - 2010-07-13 20:14:52
|
Yes, I can download the snort rules from my web browser, using the same proxy as used in oinkmaster. Since past June, oinkmaster download rules from s3.amazonaws.com:443 and I think the problem is that ActivePerl can't manage HTTPS downloads. Did you hear anything about this ??? Thanks again 2010/7/13 Russell Fulton <r.f...@au...>: > > On 14/07/2010, at 3:55 AM, Alejandro Cabrera Obed wrote: > >> Dear all, I'm contacting you because I can't see any solution in the >> wwww....I've Oinkmaster 2.0 installed in my Windows 2003 Server >> machine. I've have ActivePerl 5.12 installed and Oinkmaster 2.0, and >> Snort 2.8.5.3. >> >> I set up a HTTP_PROXY environment variable as was required for Perl >> installation. (HTTP_PROXY=http://10.4.1.10:8080). >> >> In oinkmaster.conf I've change the URL path to download the Snort >> rules since last June according to the announcement in Snort page >> about the new url including the oinkcode, it's OK because some days >> ago it worked: >> >> url = http://www.snort.org/pub-bin/oinkmaster.cgi/*my_oinkcode*/snortrules-snapshot-2853.tar.gz >> >> Now I run the same script from a command shell (Windows), in the way: >> >> c:\oinkmaster-2.0\oinkmaster.pl -C c:\oinkmaster-2.0\oinkmaster.conf >> -o "c:\snort\rules" >> >> And I've got the following error: >> >> oinkmaster.pl: Error: could not download from >> http://www.snort.org/pub-bin/oinkmaster.cgi/*my_oinkcode*/snortrules-snapshot-2853.tar.gz: >> 500 Can't connect to s3.amazonaws.com:443 (Bad hostname >> 's3.amazonaws.com') >> > > can you download from commandline or browser? This is unlikely to be an issue with oinkmaster, more likely something has changed in your netwrork set up. > > Russell > > -- Alejandro Cabrera Obed ac...@gm... www.alejandrocabrera.com.ar |
|
From: Russell F. <r.f...@au...> - 2010-07-13 20:02:27
|
On 14/07/2010, at 3:55 AM, Alejandro Cabrera Obed wrote: > Dear all, I'm contacting you because I can't see any solution in the > wwww....I've Oinkmaster 2.0 installed in my Windows 2003 Server > machine. I've have ActivePerl 5.12 installed and Oinkmaster 2.0, and > Snort 2.8.5.3. > > I set up a HTTP_PROXY environment variable as was required for Perl > installation. (HTTP_PROXY=http://10.4.1.10:8080). > > In oinkmaster.conf I've change the URL path to download the Snort > rules since last June according to the announcement in Snort page > about the new url including the oinkcode, it's OK because some days > ago it worked: > > url = http://www.snort.org/pub-bin/oinkmaster.cgi/*my_oinkcode*/snortrules-snapshot-2853.tar.gz > > Now I run the same script from a command shell (Windows), in the way: > > c:\oinkmaster-2.0\oinkmaster.pl -C c:\oinkmaster-2.0\oinkmaster.conf > -o "c:\snort\rules" > > And I've got the following error: > > oinkmaster.pl: Error: could not download from > http://www.snort.org/pub-bin/oinkmaster.cgi/*my_oinkcode*/snortrules-snapshot-2853.tar.gz: > 500 Can't connect to s3.amazonaws.com:443 (Bad hostname > 's3.amazonaws.com') > can you download from commandline or browser? This is unlikely to be an issue with oinkmaster, more likely something has changed in your netwrork set up. Russell |
|
From: Alejandro C. O. <ac...@gm...> - 2010-07-13 15:55:24
|
Dear all, I'm contacting you because I can't see any solution in the wwww....I've Oinkmaster 2.0 installed in my Windows 2003 Server machine. I've have ActivePerl 5.12 installed and Oinkmaster 2.0, and Snort 2.8.5.3. I set up a HTTP_PROXY environment variable as was required for Perl installation. (HTTP_PROXY=http://10.4.1.10:8080). In oinkmaster.conf I've change the URL path to download the Snort rules since last June according to the announcement in Snort page about the new url including the oinkcode, it's OK because some days ago it worked: url = http://www.snort.org/pub-bin/oinkmaster.cgi/*my_oinkcode*/snortrules-snapshot-2853.tar.gz Now I run the same script from a command shell (Windows), in the way: c:\oinkmaster-2.0\oinkmaster.pl -C c:\oinkmaster-2.0\oinkmaster.conf -o "c:\snort\rules" And I've got the following error: oinkmaster.pl: Error: could not download from http://www.snort.org/pub-bin/oinkmaster.cgi/*my_oinkcode*/snortrules-snapshot-2853.tar.gz: 500 Can't connect to s3.amazonaws.com:443 (Bad hostname 's3.amazonaws.com') I don't know what happen now, because I suposse the name resolution is made by the proxy as it is made using my web browser. If I download the rules from my web browser with the same proxy settings , I succed, so no name resolution problem in this scenario !!!!!! So please what's the problem with oinkmaster.pl ??? Maybe ActivePerl does not have support for SSL web sites (HTTPS) ??? Is there any reported bug ??? Thanks a lot Alejandro |
|
From: Alejandro C. O. <ac...@gm...> - 2010-07-05 20:17:55
|
Dear all, I've Oinkmaster 2.0 minstalled in my Windows machine. I've change the URL path to download the Snort rules, according to the Snort.org site definition. I run the script from a command shell (Windows), in the way: c:\oinkmaster-2.0\oinkmaster.pl -C c:\oinkmaster-2.0\oinkmaster.conf -o "c:\snort\rules" But some days ago I got the following error: oinkmaster.pl: Error: could not download from http://www.snort.org/pub-bin/oinkmaster.cgi /*oinkcode*/snortrules-snapshot-2853.tar.gz: 500 Can't connect to s3.amazonaws.com:443 (Bad hostname 's3.amazonaws.com') I put my proxy settings in the Windows variables list, so the oinkmaster can go through the proxy. And when I download from my browser from the same URL with the oinkcode http://www.snort.org/pub-bin/oinkmaster.cgi/****/snortrules-snapshot-2853.tar.gz, I can download the file successfully. So please what's the problem with oinkmaster.pl ??? Thanks a lot, -- Alejandro Cabrera Obed ac...@gm... www.alejandrocabrera.com.ar |
|
From: sagar v. <sag...@gm...> - 2009-10-13 11:20:57
|
Hi, Can we use oinkmaster with microperl ? I have downloaded source of perl-5.10.1 and made microperl out of it using following command: make -f Makefile.micro I updated oinkmaster script to use microperl instead of perl. When I run oinkmaster, I see following errors: --------------------- [root@SAGAR v1]# common/oinkmaster/oinkmaster Can't locate strict.pm in @INC (@INC contains: /usr/local/lib/perl5/5.11 /usr/local/lib/perl5/5.11 .) at common/oinkmaster/oinkmaster line 43. BEGIN failed--compilation aborted at common/oinkmaster/oinkmaster line 43. ---------------------- I thought of microperl so that disc usage would be lesser that perl and it would have no dependencies. Can anybody help me out of this ? Thanks, sagar. |
|
From: Brad P. <bra...@So...> - 2009-06-29 21:21:03
|
Good Afternoon, Every time I try to run oinkmaster I get the following errors: Oink, oink. Exiting... bash-3.2$ bash-3.2$ Downloading file from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-2.8.tar.gz... Can't exec "wget": No such file or directory at /usr/local/bin/oinkmaster.pl line 910. > > /usr/local/bin/oinkmaster.pl: Error: could not open /tmp/oinkmaster.iNUXLDXChI/wget.log for reading: No such file or directory > Any help on this would be greatly appreciated. Have a good day, It's always greener on the other side with Southwire, Reduce, Reuse, Recycle! http://www.southwire.com/legal/email_disclaimer.html |
|
From: Russell F. <r.f...@au...> - 2009-06-23 22:58:23
|
All I can suggest is to double check that you are adding the disablesid to the config file that oinkmaster is actually reading. Other obvious things to check is that you copied the sid correctly. I've had several instances of this sort of problem over the years and all have come back to errors on my part. Russell On 23/06/2009, at 9:40 AM, mai...@lo... wrote: > > I've been getting my updates from emergingthreats.net and everything > has > been working fine. Recently some in house apps started using a port > that > sets off a false positive worm alert. I went ahead and commented out > the > alert which resolved the false positive. Yesterday oinkmaster went out > and garbed the new signature alerts and overwrote the ones I commented > out. Now all the false positives are back. > > I went into the oinkmaster.conf file and added the sig ids to the > disablesid line and it is still uncommenting the rule when it gets > updated. How do I get oinkmaster to go out and update my rules, but > not > alter the rules I comment out or edit. > > Any help will be appreciated, > Thanks > > > ------------------------------------------------------------------------------ > _______________________________________________ > Oinkmaster-users mailing list > Oin...@li... > https://lists.sourceforge.net/lists/listinfo/oinkmaster-users |
|
From: <mai...@lo...> - 2009-06-22 22:13:27
|
I've been getting my updates from emergingthreats.net and everything has been working fine. Recently some in house apps started using a port that sets off a false positive worm alert. I went ahead and commented out the alert which resolved the false positive. Yesterday oinkmaster went out and garbed the new signature alerts and overwrote the ones I commented out. Now all the false positives are back. I went into the oinkmaster.conf file and added the sig ids to the disablesid line and it is still uncommenting the rule when it gets updated. How do I get oinkmaster to go out and update my rules, but not alter the rules I comment out or edit. Any help will be appreciated, Thanks |
|
From: Andreas Ö. <and...@br...> - 2009-06-15 15:16:48
|
Sounds good, Russell. As you've probably noticed I don't have very much time to develop Oinkmaster these days so any help is much appreciated. Btw, several people have asked about Oinkmaster and the so_rules stuff. Basic support for this has been in the cvs version for some time but it's still not in the latest release. See the news at http://oinkmaster.sourceforge.net/ for more info. /Andreas Russell Fulton wrote: > I am also hacking oinkmaster by adding a -k <keep-dir> which tells > oinkmaster to keep the tarballs in the indicated directory and only > download them if it really needs to. As expected this change is non > trivial as it changes one of the fundamental assumptions about how > files are downloaded. That said the code is well structured and > documented so it is no where near as bad as it could be (Thanks > Andreas :) |
|
From: JJ C. <cum...@gm...> - 2009-06-15 04:26:04
|
There is also a new snort rule handling tool that was recently published that accomplishes all of this and more called pulledpork: http://code.google.com/p/pulledpork it will verify the md5 before extracting... or if the md5 matches what you have already downloaded not re-download, handle shared object rules and much more. Cheers, JJC On Sun, Jun 14, 2009 at 6:39 PM, Zakai Kinan <tit...@ya...> wrote: > > Can you send the script to the list? > > > Thanks, > > ZK > > --- On Sun, 6/14/09, Russell Fulton <r.f...@au...> wrote: > > > From: Russell Fulton <r.f...@au...> > > Subject: [Snort-users] Snort VRT rules > > To: "The EDUCAUSE Security Constituent Group Listserv" < > SEC...@LI...> > > Cc: sno...@li..., > oin...@li... > > Date: Sunday, June 14, 2009, 4:17 PM > > Just an FYI and apologies for the > > cross posting > > > > As many of you are no doubt already well aware the snort > > rules snap > > shot file is now approaching 100MB and is very slow to down > > load. > > > > What you may not know is that now that the new snort web > > site is up > > the snapshot file is no longer being rebuilt every day so > > you can now > > rely on the http header stuff to decide whether or not to > > download the > > file. They also have md5 files which you can check if > > you are really > > don't trust the http headers. > > > > I am now using -N on wget and have drastically reduced the > > headaches > > in downloading the VRT rules. > > > > I have my own script that I use for downloading rule files > > and this > > now works happily with the new set up. > > > > I am happy to share this script if anyone is > > interested. It downloads > > and optionally unpacks tarballs. I use it since I > > have several > > sensors with different oinkmaster.confs and with the large > > files I > > unpack them as well - this speeds up the oinkmaster > > processing > > considerably. > > > > I am also hacking oinkmaster by adding a -k > > <keep-dir> which tells > > oinkmaster to keep the tarballs in the indicated directory > > and only > > download them if it really needs to. As expected this > > change is non > > trivial as it changes one of the fundamental assumptions > > about how > > files are downloaded. That said the code is well > > structured and > > documented so it is no where near as bad as it could be > > (Thanks > > Andreas :) > > > > I'm also going to try and get the messages back from the > > web sessions > > so that you know when you are being excluded by the > > download limit > > (rather than just getting a 403. > > > > Russell > > > > > ------------------------------------------------------------------------------ > > Crystal Reports - New Free Runtime and 30 Day Trial > > Check out the new simplified licensing option that enables > > unlimited > > royalty-free distribution of the report engine for > > externally facing > > server and web deployment. > > http://p.sf.net/sfu/businessobjects > > _______________________________________________ > > Snort-users mailing list > > Sno...@li... > > Go to this URL to change user options or unsubscribe: > > https://lists.sourceforge.net/lists/listinfo/snort-users > > Snort-users list archive: > > http://www.geocrawler.com/redir-sf.php3?list=snort-users > > > > > > > > ------------------------------------------------------------------------------ > Crystal Reports - New Free Runtime and 30 Day Trial > Check out the new simplified licensing option that enables unlimited > royalty-free distribution of the report engine for externally facing > server and web deployment. > http://p.sf.net/sfu/businessobjects > _______________________________________________ > Snort-users mailing list > Sno...@li... > Go to this URL to change user options or unsubscribe: > https://lists.sourceforge.net/lists/listinfo/snort-users > Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0ASnort-users>list archive: > http://www.geocrawler.com/redir-sf.php3?list=snort-users > |
|
From: Zakai K. <tit...@ya...> - 2009-06-15 01:06:38
|
Can you send the script to the list? Thanks, ZK --- On Sun, 6/14/09, Russell Fulton <r.f...@au...> wrote: > From: Russell Fulton <r.f...@au...> > Subject: [Snort-users] Snort VRT rules > To: "The EDUCAUSE Security Constituent Group Listserv" <SEC...@LI...> > Cc: sno...@li..., oin...@li... > Date: Sunday, June 14, 2009, 4:17 PM > Just an FYI and apologies for the > cross posting > > As many of you are no doubt already well aware the snort > rules snap > shot file is now approaching 100MB and is very slow to down > load. > > What you may not know is that now that the new snort web > site is up > the snapshot file is no longer being rebuilt every day so > you can now > rely on the http header stuff to decide whether or not to > download the > file. They also have md5 files which you can check if > you are really > don't trust the http headers. > > I am now using -N on wget and have drastically reduced the > headaches > in downloading the VRT rules. > > I have my own script that I use for downloading rule files > and this > now works happily with the new set up. > > I am happy to share this script if anyone is > interested. It downloads > and optionally unpacks tarballs. I use it since I > have several > sensors with different oinkmaster.confs and with the large > files I > unpack them as well - this speeds up the oinkmaster > processing > considerably. > > I am also hacking oinkmaster by adding a -k > <keep-dir> which tells > oinkmaster to keep the tarballs in the indicated directory > and only > download them if it really needs to. As expected this > change is non > trivial as it changes one of the fundamental assumptions > about how > files are downloaded. That said the code is well > structured and > documented so it is no where near as bad as it could be > (Thanks > Andreas :) > > I'm also going to try and get the messages back from the > web sessions > so that you know when you are being excluded by the > download limit > (rather than just getting a 403. > > Russell > > ------------------------------------------------------------------------------ > Crystal Reports - New Free Runtime and 30 Day Trial > Check out the new simplified licensing option that enables > unlimited > royalty-free distribution of the report engine for > externally facing > server and web deployment. > http://p.sf.net/sfu/businessobjects > _______________________________________________ > Snort-users mailing list > Sno...@li... > Go to this URL to change user options or unsubscribe: > https://lists.sourceforge.net/lists/listinfo/snort-users > Snort-users list archive: > http://www.geocrawler.com/redir-sf.php3?list=snort-users > |
|
From: Nigel H. <nho...@so...> - 2009-06-15 01:02:08
|
On Sun, Jun 14, 2009 at 7:17 PM, Russell Fulton<r.f...@au...> wrote: > Just an FYI and apologies for the cross posting > > As many of you are no doubt already well aware the snort rules snap > shot file is now approaching 100MB and is very slow to down load. > > What you may not know is that now that the new snort web site is up > the snapshot file is no longer being rebuilt every day so you can now > rely on the http header stuff to decide whether or not to download the > file. They also have md5 files which you can check if you are really > don't trust the http headers. FYI: The snapshot wasn't being built on a daily basis on the old snort.org site either. -- Nigel Houghton Head Mentalist SF VRT http://vrt-sourcefire.blogspot.com && http://www.snort.org/vrt/ |
|
From: Russell F. <r.f...@au...> - 2009-06-14 23:18:05
|
Just an FYI and apologies for the cross posting As many of you are no doubt already well aware the snort rules snap shot file is now approaching 100MB and is very slow to down load. What you may not know is that now that the new snort web site is up the snapshot file is no longer being rebuilt every day so you can now rely on the http header stuff to decide whether or not to download the file. They also have md5 files which you can check if you are really don't trust the http headers. I am now using -N on wget and have drastically reduced the headaches in downloading the VRT rules. I have my own script that I use for downloading rule files and this now works happily with the new set up. I am happy to share this script if anyone is interested. It downloads and optionally unpacks tarballs. I use it since I have several sensors with different oinkmaster.confs and with the large files I unpack them as well - this speeds up the oinkmaster processing considerably. I am also hacking oinkmaster by adding a -k <keep-dir> which tells oinkmaster to keep the tarballs in the indicated directory and only download them if it really needs to. As expected this change is non trivial as it changes one of the fundamental assumptions about how files are downloaded. That said the code is well structured and documented so it is no where near as bad as it could be (Thanks Andreas :) I'm also going to try and get the messages back from the web sessions so that you know when you are being excluded by the download limit (rather than just getting a 403. Russell |
|
From: Oscar M. B. S. <obe...@gm...> - 2009-06-09 14:38:01
|
thak's for your answers, now i can download, maybe was a problem with the servers on snort or solmething like that. |
|
From: Russell F. <r.f...@au...> - 2009-06-09 09:17:10
|
some of us paying customers have been giving sourcefire a hard time over that. I have at least one day a week where I fail to download. THe really silly thing is that the rule set changes about once every two weeks but there is no simple way of knowing when you need to download. Things were supposed to change after the new web site went live but I have not checked recently. R On 9/06/2009, at 8:14 PM, Rick Hewett wrote: > On Tue 09 Jun Russell Fulton wrote: >> You may have run foul of sourcefire's download restriction. If you >> connect more than 3 times in an hour you can't download for several >> hours. > > ....and that's not helped by the download being so huge these days > that > sometimes the download fails part-way through, and the re-connect > seems > to get counted as a new attempt. > > -- > ...Rick Hewett http://www.chocky.demon.co.uk/ > > > ------------------------------------------------------------------------------ > Crystal Reports - New Free Runtime and 30 Day Trial > Check out the new simplified licensing option that enables unlimited > royalty-free distribution of the report engine for externally facing > server and web deployment. > http://p.sf.net/sfu/businessobjects > _______________________________________________ > Oinkmaster-users mailing list > Oin...@li... > https://lists.sourceforge.net/lists/listinfo/oinkmaster-users |
|
From: Rick H. <sn...@ch...> - 2009-06-09 08:33:07
|
On Tue 09 Jun Russell Fulton wrote: > You may have run foul of sourcefire's download restriction. If you > connect more than 3 times in an hour you can't download for several > hours. ....and that's not helped by the download being so huge these days that sometimes the download fails part-way through, and the re-connect seems to get counted as a new attempt. -- ...Rick Hewett http://www.chocky.demon.co.uk/ |
|
From: Russell F. <r.f...@au...> - 2009-06-09 02:18:39
|
You may have run foul of sourcefire's download restriction. If you connect more than 3 times in an hour you can't download for several hours. Russell On 9/06/2009, at 4:55 AM, Oscar Mauricio Benavidez Suarez wrote: > well my problem about oinkmaster is i can't download the rules, i > pue the follow data in oinkmaster.conf > > > url=http://www.snort.org/pub-bin/oinkmaster.cgi/404f7417962e06de4dd0485e57b8444e653ad49c/snortrules-snapshot-CURRENT.tar.gz > > i probe this link in to the web browser and it works, but if i try > to do this in this way > > oinkmaster -o /etc/snort_inline/rules/ -b /etc/snort_inline/backup/ > 2>&1 > > the messeage is the follow > > Loading /etc/oinkmaster.conf > Downloading file from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-CURRENT.tar.gz > ... > /usr/sbin/oinkmaster: Error: could not download from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-CURRENT.tar.gz > . Output from wget follows: > > http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-CURRENT.tar.gzResolviendo > www.snort.org... 68.177.102.20 > Connecting to www.snort.org|68.177.102.20|:80... conectado. > Petición HTTP enviada, esperando respuesta... 302 Found > Localización: http://dl.snort.org/reg-rules/snortrules-snapshot-CURRENT.tar.gz?oink_code=404f7417962e06de4dd0485e57b8444e653ad49c > [siguiendo] > --2009-06-08 11:48:04-- http://dl.snort.org/reg-rules/snortrules-snapshot-CURRENT.tar.gz?oink_code=404f7417962e06de4dd0485e57b8444e653ad49c > Resolviendo dl.snort.org... 68.177.102.34 > Connecting to dl.snort.org|68.177.102.34|:80... conectado. > Petición HTTP enviada, esperando respuesta... 403 Forbidden > 2009-06-08 11:48:07 ERROR 403: Forbidden. > > > Oink, oink. Exiting... > > so i don't know what i'm doing wrong, please some help about this > thank's list. > <ATT00001.txt><ATT00002.txt> |
|
From: Oscar M. B. S. <obe...@gm...> - 2009-06-08 16:55:45
|
well my problem about oinkmaster is i can't download the rules, i pue the follow data in oinkmaster.conf url= http://www.snort.org/pub-bin/oinkmaster.cgi/404f7417962e06de4dd0485e57b8444e653ad49c/snortrules-snapshot-CURRENT.tar.gz i probe this link in to the web browser and it works, but if i try to do this in this way oinkmaster -o /etc/snort_inline/rules/ -b /etc/snort_inline/backup/ 2>&1 the messeage is the follow Loading /etc/oinkmaster.conf Downloading file from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-CURRENT.tar.gz... /usr/sbin/oinkmaster: Error: could not download from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-CURRENT.tar.gz. Output from wget follows: http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-CURRENT.tar.gzResolviendowww.snort.org... 68.177.102.20 Connecting to www.snort.org|68.177.102.20|:80... conectado. Petición HTTP enviada, esperando respuesta... 302 Found Localización: http://dl.snort.org/reg-rules/snortrules-snapshot-CURRENT.tar.gz?oink_code=404f7417962e06de4dd0485e57b8444e653ad49c[siguiendo] --2009-06-08 11:48:04-- http://dl.snort.org/reg-rules/snortrules-snapshot-CURRENT.tar.gz?oink_code=404f7417962e06de4dd0485e57b8444e653ad49c Resolviendo dl.snort.org... 68.177.102.34 Connecting to dl.snort.org|68.177.102.34|:80... conectado. Petición HTTP enviada, esperando respuesta... 403 Forbidden 2009-06-08 11:48:07 ERROR 403: Forbidden. Oink, oink. Exiting... so i don't know what i'm doing wrong, please some help about this thank's list. |
|
From: Russell F. <r.f...@au...> - 2009-05-13 00:52:05
|
HI folks I have just been setting up so_rules on my sensors and got confused because oinkmaster.pl kept rejecting the rules_dir config. I checked that I had the most recent tarball and then I remembered someone saying one needed the CVS version for this to work. Pulled the version from CVS and it all worked. I suggest either the tarball gets updated or someone tweaks the FAQ to mention that you need to get the version from CVS. Russell |
3 messages has been excluded from this view by a project administrator.
