[Snort-users] Script for Updating Snort Rules

Ronneil Camara ronneilc at ...4042...
Thu Jan 24 12:15:09 EST 2002

Hi guys,

I would like to share this program which will compare an old snort rule against 
a newly downloaded snort rules. Then comment the rule in newsnortrule if it
was commented out also in your existing snort rules.

This is for snort 1.8.3.

This script was first developed by David Bouscasse. I had some errors on it
like when it encounters special characters like "\", grep fails on it.
But I thank David for his wonderful idea. :-)

I added lines to fix the problem. Also added some conditional statement
to verify if the line was really a rule. 

I also made it in such a way that it will automatically pull the latest and
greatest snortrules.tar.gz from snort.org.

I have tested it and was happy with the output.

Usage: sh updaterule.sh [old snort dir with rules file] [temp directory, must not exist!]
Example: sh updaterule.sh /etc/snort /etc/newsnort

NOTE: You can just chmod 500 updaterule.sh if you don't like the syntax above. :-)

BTW, the file was saved using vi. So for guys using notepad in windoze, it might not
be displayed correctly. You can also grabbed a copy of this script at

Hope this helps. I am also in the process of adding this functionality to ACID.
I just don't know if I am allowed. :-)

neil camara (ronneilc at ...4042...) - cc{na|sa}, mcse - pgp 0x777777B2 
network/security engineer - dl := +1(847) cn := +1(847) 
        echo "I love windows" | sed -e 's/wi/u/g' | cut -f1 -dd | \
              awk '/u/ {printf("%s %s %six\n",$1,$2,$3)}'
                 ---o0 Statement of Confidentiality 0o--- 
The contents of this message and its attachments and subsequent additions are 
strictly confidential and proprietary and intended solely for the addressee(s) 
hereof.  If you are not the named addressee, or this message has been addressed 
to you in error, you are directed not to read, disclose, reproduce, distribute, 
disseminate or otherwise use thistransmission.  Delivery of this message to 
any other person other than the intended recipient(s) is not intended in any 
way to waive privilege or confidentiality.  If you have received this transmis- 
sion in error, please alert the sender by reply e-mail; we also request that 
you immediately delete this message and its attachments, if any.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: updaterule.sh
Type: application/octet-stream
Size: 3105 bytes
Desc: updaterule.sh
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020124/fbf43245/attachment.obj>

More information about the Snort-users mailing list