[Snort-users] rules downloads and scalability

Jason Haar Jason.Haar at ...294...
Sun Sep 17 22:34:24 EDT 2006

I notice the "www.snort.org/pub-bin/oinkmaster.cgi" script has some form
of download limiting component (to stop people like me repeatably
downloading the same live data while editing/updating local scripts - ahem).

Anyway, such scaling issues happen. I'd like to suggest that Sourcefire
look to ClamAV to see how they handled people hammering their servers
looking for updates that didn't exist (i.e. they were already up to
date). Their rules basically have a serial number and they put that into
a DNS record, and then their freshclam update daemon looks to that DNS
record before deciding to actually do a HTTP connection to download an
update. Than plus some time-of-day randomization and load sharing should
go a loooong way on the scalability side...

Just an idea.


Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

More information about the Snort-users mailing list