[Snort-users] SnortSnarf version 041501.1

James Hoagland hoagland at ...47...
Mon Apr 16 18:29:38 EDT 2001


At 5:02 PM -0500 4/16/01, Burleson, Lee (IA) wrote:
>Jim -
>
>Well, I happen to also have a copy of netcat (for Win32), and I tested it
>out.  Incredibly, I was able to open the .gz file just fine.  According to
>your logic, that means that there probably is a browser problem.  I can hear
>the public sigh as I tell you that I've been using IE5.5, but that does not
>solve the mystery of being able to use the .gz from snort.org.
>
>I don't have a uuencode program, so if you still want the IE-downloaded .gz
>file in UU format, I'll have to get one from the Net somewhere.
>
>But here's a clue: the file size of the IE-dl'ed .gz is 542,720 bytes,
>whereas the nc file is 120,629 bytes.

Ah!  542720 is the exact size of the .tar.  It looks like IE simply 
gunzipped it for you without removing the .gz suffix.

The other possibility is that the Silicon Defense web server treated 
you differently when you were using IE and gunzipped the file for 
you.  Not sure why it would do that though.

For those that want to bypass a full web browser and have netcat 
installed can download the SnortSnarf distribution by the following:

% nc www.silicondefense.com 80 > SnortSnarf-041501.1.tar.gz
GET /software/snortsnarf/SnortSnarf-041501.1.tar.gz
^D

I came up with that after lynx -source started gunzipping files 
without prompting.

Regards,

   Jim
-- 
|*   Jim Hoagland, Associate Researcher, Silicon Defense    *|
|*               hoagland at ...47...                *|
|*              http://www.silicondefense.com/              *|
|*      Silicon Defense - Technical Support for Snort       *|
|*  Voice: (530) 756-7317              Fax: (530) 756-7297  *|




More information about the Snort-users mailing list