<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><base href="http://blog.snort.org/2012/10/sourcefire-vrt-certified-snort-rules_9.html"><br><a href="http://blog.snort.org/2012/10/sourcefire-vrt-certified-snort-rules_9.html">http://blog.snort.org/2012/10/sourcefire-vrt-certified-snort-rules_9.html</a><br><br><br>The following changes were made to the snort.conf:<br><br>portvar HTTP_PORTS [80,81,311,591,593,901,1220,1414,1741,1830,2301,2381,2809,3128,3702,4343,4848,5250,7001,7145,7510,7777,7779,8000,8008,8014,8028,8080,8088,8090,8118,8123,8180,8181,8243,8280,8800,8888,8899,9000,9080,9090,9091,9443,9999,11371,55555] <br><br>now reads:<br><br>portvar HTTP_PORTS [80,81,311,591,593,901,1220,1414,1741,1830,2301,2381,2809,3128,3702,4343,4848,5250,7001,7145,7510,7777,7779,8000,8008,8014,8028,8080,8088,8090,8118,8123,8180,8181,8243,8280,8800,8888,8899,9000,9060,9080,9090,9091,9443,9999,11371,55555] <br><br>(Addition of 9060)<br><br>The port was also added to stream5 and http_inspect's configuration lines.<br><br>I have updated the example snort.conf's, they can be found here: <div><a href="http://www.snort.org/vrt/snort-conf-configurations/">http://www.snort.org/vrt/snort-conf-configurations/</a></div><div><br></div><div>Thanks!</div><div><br></div><div><div>--</div><div>Joel Esler</div><div>Senior Research Engineer, VRT</div><div>OpenSource Community Manager</div><div>Sourcefire</div></div></body></html>