[Snort-users] RE: [Snort-sigs] sigs with asn1 fails

Joshua Berry jberry at ...11848...
Wed Jul 28 08:07:03 EDT 2004


This was my point.  That I haven't seen the asn1 keyword at all when
using www.snort.org/dl/rules/snortrules-snapshot-2_1.tar.gz (which is
how it is supposed to be but some people are complaining that they are
and that it is hosing their Snort 2.1.3).

What I was saying is that it was highly unlikely given that I
auto-update every 12 hours and haven't seen the problem.  The only thing
that I could think of that could be happening is they are pointed to
www.snort.org/dl/rules/snortrules-snapshot-CURRENT.tar.gz and not
snapshot-2_1.tar.gz.

-----Original Message-----
From: Brian [mailto:bmc at ...950...] 
Sent: Wednesday, July 28, 2004 9:40 AM
To: Joshua Berry
Cc: snort
Subject: Re: [Snort-sigs] sigs with asn1 fails

On Wed, Jul 28, 2004 at 08:44:30AM -0500, Joshua Berry wrote:
> I update twice a day with oinkmaster pointed to
> www.snort.org/dl/rules/snortrules-snapshot-2_1.tar.gz and have not
seen
> the asn1 keyword in any of the rules I downloaded.  However, I tested
> downloading www.snort.org/dl/rules/snortrules-snapshot-2_1.tar.gz and
it
> has the keyword and so does
> www.snort.org/dl/rules/snortrules-snapshot-CURRENT.tar.gz
> 
> Maybe these people are using the CURRENT rules, or I just happen to be
> downloading when they fix the problem every single time.

Uh, fix the problem every single time?  I've never seen the rules get
asn1 added to them.  These files are generated automagically every
hour from a simple cvs update & tar.

If you see it, send me the complete tgz and I'll look into it.

Brian




More information about the Snort-users mailing list