[Snort-users] so_rules - only small subset compiling and usable

chris ryan chris.ryan at ...348...
Mon Aug 4 05:49:40 EDT 2008


i've just compiled the so-rules with snort from the latest
tarball (registered users release) without any errors.
I have to compile the rules myself because the precompiled libaries are
not available for my platform (Debian Lenny, Snort from source [1]).

One thing is odd:
The rule count for the precompiled libraries is > 80.

Not matter what i do, when i compile the so_rules myself,
i've only 22 rules in the generated stub rule files.

Also, the precompiled libaries are more that twice as big at the disk.
So in effect, i can only use a subset of 22 rules.

Can anybody give me a hint what's my mistake?

Thanks in advance, Chris.

[1] compile options:
 ./configure --prefix=/usr --bindir=/usr/bin --sysconfdir=/etc/snort
--enable-pthread --enable-rulestate --enable-dynamicplugin
--enable-timestats --enable-perfprofiling --enable-linux-smp-stats
--enable-snmp --with-mysql=/usr/share/mysql
--with-mysql-libraries=/usr/lib --with-mysql-includes=/usr/include/mysql
--with-libpq-libraries=/usr/lib/postgresql --enable-dynamicplugin
--enable-decoder-preprocessor-rules --enable-ppm

More information about the Snort-users mailing list