[Snort-sigs] sigs with asn1 fails

Eric Hines eric.hines at ...1663...
Wed Jul 28 10:01:24 EDT 2004


Brian,

Our customer had the snortrules-current-2.1 tarball + our software runs an
md5 on it, which matched the md5 of the tarball on snort.org. Unfortunately,
we deleted it after having to push out the correct rules to all the agents.
Perhaps the cvs update burped and several of us downloaded the 2-1 tarball
just as the right time? 


Best Regards,


Eric Hines, GCIA, CISSP
CEO, President
Applied Watch Technologies, Inc.
Direct: (877) 262-7593 x327


-----------------------------------------

Address: 4204 Commercial Way
         Glenview, IL 60025
         Toll Free: (877) 262-7593
         Fax: (877) 262-7593
         http://www.appliedwatch.com

-----------------------------------------





-----Original Message-----
From: Brian [mailto:bmc at ...95...] 
Sent: Wednesday, July 28, 2004 9:40 AM
To: Joshua Berry
Cc: snort
Subject: Re: [Snort-sigs] sigs with asn1 fails

On Wed, Jul 28, 2004 at 08:44:30AM -0500, Joshua Berry wrote:
> I update twice a day with oinkmaster pointed to 
> www.snort.org/dl/rules/snortrules-snapshot-2_1.tar.gz and have not 
> seen the asn1 keyword in any of the rules I downloaded.  However, I 
> tested downloading 
> www.snort.org/dl/rules/snortrules-snapshot-2_1.tar.gz and it has the 
> keyword and so does 
> www.snort.org/dl/rules/snortrules-snapshot-CURRENT.tar.gz
> 
> Maybe these people are using the CURRENT rules, or I just happen to be 
> downloading when they fix the problem every single time.

Uh, fix the problem every single time?  I've never seen the rules get
asn1 added to them.  These files are generated automagically every hour from
a simple cvs update & tar.

If you see it, send me the complete tgz and I'll look into it.

Brian


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise
J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs






More information about the Snort-sigs mailing list