[Snort-sigs] Rules md5sum file name and contents

Nigel Houghton nhoughton at ...435...
Fri May 29 08:23:28 EDT 2009

On Fri, May 29, 2009 at 5:06 AM, Zultan <zultan at ...1298...> wrote:
> I'm not sure if this is a VRT team issue or a webmaster issue.
> After the move to the new snort.org web-site, the rules md5sum file name changed, and its contents changed.
> Before it was simple:
> filename = snortrules-snapshot-2.8.tar.gz.md5
> contents = cc34f4fc83c2edc0dac108f642f360f8 - a simple 33 byte string
> But now, wget pulls a file named with my oinkcode appended to it.  Is there a really a good reason for this change?
> Example:  snortrules-snapshot-2.8_s.tar.gz.md5?oink_code=<oinkcode>
> Who wants a file name that extends over halfway across the screen, with ? and = in it as well?

Sounds like a web issue. The file name certainly would not look like
that, I'll pass the information along to the web guys. (actually,
since you CC'd them, I'll just follow up later)

> And, the content of this monster is:  cat snortrules-snapshot-2.8_s.tar.gz.md5?oink_code*
> MD5 (snortrules-snapshot-2.8_s.tar.gz) = cc34f4fc83c2edc0dac108f642f360f8
> Why does anyone need to be told, "MD5 (snortrules-snapshot-2.8_s.tar.gz) ="?
> What was broken with the previous md5sum files that required this change?

This is the output of 'md5 <file name>'. Try it. On some systems it
may be 'md5sum <file name>'. You may also get something like "<md5
sum> <file name>" as the output too. The old output was the result of
using "-q" on that command which then only produces the md5 sum of the

For my money, the command *should* produce an md5 sum text file that
is of the form "MD5 (snortrules-snapshot-2.8_s.tar.gz) = <md5 sum>"
it's pretty easy to parse and therefore, to automate.

> ----------
> Now I'm going to whine......

Please don't. I really do not like whiners.

Nigel Houghton
Head Mentalist
http://vrt-sourcefire.blogspot.com && http://www.snort.org/vrt/

More information about the Snort-sigs mailing list