[Snort-users] rules downloads and scalability

Eric Hines eric.hines at ...8860...
Sun Sep 17 22:59:27 EDT 2006


Its not limiting specific to Oinkmaster. Applied Watch began seeing this 
a few weeks ago through regular rule downloads with our Command Center 
using specific Oink Code. Sourcefire seems to be limiting user-specific 
Oink Code to download rules only once a day.

Eric Hines, GCIA, CISSP
CEO, President
Applied Watch Technologies, LLC
1095 Pingree Road
Suite 221
Crystal Lake, IL 60014
Tel: (877) 262-7593
Web: http://www.appliedwatch.com

Jason Haar wrote:
> I notice the "www.snort.org/pub-bin/oinkmaster.cgi" script has some form
> of download limiting component (to stop people like me repeatably
> downloading the same live data while editing/updating local scripts - ahem).
> Anyway, such scaling issues happen. I'd like to suggest that Sourcefire
> look to ClamAV to see how they handled people hammering their servers
> looking for updates that didn't exist (i.e. they were already up to
> date). Their rules basically have a serial number and they put that into
> a DNS record, and then their freshclam update daemon looks to that DNS
> record before deciding to actually do a HTTP connection to download an
> update. Than plus some time-of-day randomization and load sharing should
> go a loooong way on the scalability side...
> Just an idea.

More information about the Snort-users mailing list