[Snort-users] Updating Rules?

Andreas Östling andreaso at ...236...
Thu Feb 12 13:42:15 EST 2004

On Thu, 12 Feb 2004, Dusty Hall wrote:

> Which should I use for 2.1.0?   Is 2.1.1 RC1 the "currently "shipping"
> snort"?  Should I update? 

Because of the alert mixup bug in Snort 2.1.0, I think it should be 
avoided. Snort 2.1.1 RC1 works fine from what I can tell, so I think you 
should use 2.1.1 RC1 and the 2_1 rules (or 2.0.6 and the 2_0 rules until 
2.1.1 is released). Another reason to avoid 2.1.0 is that it doesn't have 
the flowbits feature which the 2_1 rules currently requires (which I guess 
they really shouldn't, but that's a known issue that has already been 
mentioned on the lists, and it doesn't really matter as 2.1.1 RC1 is the 
way to go anyway).

> Thank goodness I don't use oinkmaster to autoupdate...

Can you please explain what you mean by this?
Autoupdate is of course always a risk, especially if you for some 
mysterious reason do it without using snort -T on the new rules before 
loading them. I haven't had any problems with Oinkmaster or the update 

Btw, for those who actually use Oinkmaster and Snort 2.1.1 and want to use 
the 2_1 rules, a simple workaround to disable all the 'flowbits' rules
(temporary, until you use a Snort that can handle them) can be (assuming 
Oinkmaster >= 0.9):

modifysid * "(.*\bflowbits:.*)" | "#$1"

Or simply "disablesid 2192,2350,2348,2349,2352", or use some modifysid 
statement or sed command or whatever to remove only the 'flowbits' parts 
if that is what you want.


More information about the Snort-users mailing list