[Snort-sigs] Snort Rules

Joel Esler jesler at ...435...
Wed Sep 19 14:16:16 EDT 2012


On Sep 19, 2012, at 12:59 PM, PR <oly562 at ...2420...> wrote:

> does one have to use precompiled binaries for initial install?
> 
Not if you don't want to.

> can we just leave out this line, since this servers is 12.04 not 10.04
> ubuntu server?
> 
> referring to this howto
> 
> sudo
> cp /usr/local/snort/so_rules/precompiled/Ubuntu-10-4/i386/2.9.3.0/* /usr/local/snort/lib/snort_dynamicrules
> 

We support 12.04, perhaps you need to specify the correct version and arch in your pulledpork.conf

https://www.snort.org/snort-rules/shared-object-rules

> 
> also, isn't the version 2.9.3.1? not .0?

It should be automatically detected by pulledpork.  But it is possible to manually specify it in the pulledpork.conf

> 
> when do you guys usually change versions, and will any 2.9.x.x version
> work with 2.9.3 snort tar?

Generally, but not always.  We recommend that you stay current.





More information about the Snort-sigs mailing list