[Snort-users] Signature DB - Is it being updated?

Brian bmc at ...950...
Mon Mar 4 05:22:05 EST 2002


> I know the sig people are probably very busy, but a signature I queued up,
> wrote a report for and submitted it 2 about hours later on Friday had gone
> back on the unfinished list.  I've checked a couple of ofther sigs that have
> been submitted to the list about the same time and they seem to have
> suffered the same fate ....   
> 
> If it is not possible to keep up with 'flood' ;-) then would it not be 
> sensible to increase the timeout a little before returning them to the 
> unfinished list?  

We started out doing that, then a jerk queued every signature all at
once.  Instead of engineering an overly complex solution to the
problem, I set the queue timeout to 24 hours.  

I've bumped up the queue timeout to 72 hours to give the reviewers 
a bit more of a buffer.  

Again, thanks for submitting information.  I really appreciate the
hard work from everyone, as does most every snort user I am sure.

Just FYI, I am working on a method to bundle up the information in a
format that allows for easily redistribution (and printing). 

-- 
ALL programs are poems, it's just that not all programmers are poets.
-- Jonathan Guthrie in the scary.devil.monastery





More information about the Snort-users mailing list