[Snort-users] More problems with pulledpork 0.6.0

carlopmart carlopmart at ...11827...
Fri Apr 1 11:57:53 EDT 2011

On 04/01/2011 05:26 PM, JJC wrote:
> Ok, I see the problem... PP has no way of knowing that the rules you are
> putting on your custom-url-server are ET rules (it determines if it's
> VRT or ET based on the source url), thus the other errors (in your bug)
> that you are reporting and the behavior that you see.  If you remove the
> ET- from your dropsid and disablesid config.  I will be publishing a
> bugfix today for that (0.6.1) that will fix both issues, but require you
> to use Custom-<category> when retrieving from a purely custom url, such
> as you are doing.

Ok. All works as expected now disabling ET- . But, why not to use in the 
new version "Custom-ET-" and "Custom-VRT-" instead of "Custom-"? With 
this mode you can prevent that VRT and ET release a .rules file with the 
same name.

Thanks JJC.

CL Martinez
carlopmart {at} gmail {d0t} com

More information about the Snort-users mailing list