[Snort-users] RE: [Snort-sigs] sigs with asn1 fails

Joshua Berry jberry at ...11848...
Wed Jul 28 08:07:03 EDT 2004

This was my point.  That I haven't seen the asn1 keyword at all when
using www.snort.org/dl/rules/snortrules-snapshot-2_1.tar.gz (which is
how it is supposed to be but some people are complaining that they are
and that it is hosing their Snort 2.1.3).

What I was saying is that it was highly unlikely given that I
auto-update every 12 hours and haven't seen the problem.  The only thing
that I could think of that could be happening is they are pointed to
www.snort.org/dl/rules/snortrules-snapshot-CURRENT.tar.gz and not

-----Original Message-----
From: Brian [mailto:bmc at ...950...] 
Sent: Wednesday, July 28, 2004 9:40 AM
To: Joshua Berry
Cc: snort
Subject: Re: [Snort-sigs] sigs with asn1 fails

On Wed, Jul 28, 2004 at 08:44:30AM -0500, Joshua Berry wrote:
> I update twice a day with oinkmaster pointed to
> www.snort.org/dl/rules/snortrules-snapshot-2_1.tar.gz and have not
> the asn1 keyword in any of the rules I downloaded.  However, I tested
> downloading www.snort.org/dl/rules/snortrules-snapshot-2_1.tar.gz and
> has the keyword and so does
> www.snort.org/dl/rules/snortrules-snapshot-CURRENT.tar.gz
> Maybe these people are using the CURRENT rules, or I just happen to be
> downloading when they fix the problem every single time.

Uh, fix the problem every single time?  I've never seen the rules get
asn1 added to them.  These files are generated automagically every
hour from a simple cvs update & tar.

If you see it, send me the complete tgz and I'll look into it.


More information about the Snort-users mailing list