[Snort-users] More problems with pulledpork 0.6.0

carlopmart carlopmart at ...11827...
Fri Apr 1 12:23:26 EDT 2011


On 04/01/2011 06:14 PM, JJC wrote:
> The reasoning is simple, there is no reliable way, other than using a
> known trusted url identification to determine the source of the rules.
>   Consider the case of ETPRO rules vs VRT rules, there are sids that
> match, the contained filenames match exactly, and you  may have changed
> the source tarball name when you put it on your custom server url...  I
> will likely (in the next major release) make that a configurable
> option.. such as rule_url=<url>|<filename>|<oinkcode>|<prependname> or
> something...
>
> Oh, 0.6.1 is up and has your fix in it...
>
> JJC
>

Many thanks JJC.

-- 
CL Martinez
carlopmart {at} gmail {d0t} com




More information about the Snort-users mailing list