[Snort-users] Problem with snort,oinkmaster, and feed

Carney, Megan Megan.Carney at ...15229...
Tue Apr 12 10:46:47 EDT 2011


I'm having a problem with snort and the latest feed that I haven't
managed to find solutions for on Google. I thought maybe someone on this
list would have some hints?

When I run the command to update the active rules I get this error from
oinkmaster:
/usr/sbin/oinkmaster: Error: incorrect URL:
"http://www.snort.org/sub-rules/snortrules-snapshot-2904.tar.gz/license-
code-redacted/

The command I'm using is "/usr/sbin/oinkmaster -b /etc/snort/backup -i
-C /etc/oinkmaster.conf -C /etc/autodisable.conf -o /etc/snort/rules/".

The URL works from the same machine if I use wget to download the file
manually.  So I can get around this by downloading the file manually and
pointing towards the file with this command:
"/usr/sbin/oinkmaster -b /etc/snort/backup -i -C /etc/oinkmaster.conf -C
/etc/autodisable.conf -o /etc/snort/rules/ -u
file://snortrules-snapshot-2904.tar.gz"

But it's a pain and I don't understand why the link isn't working within
oinkmaster - any hints?

Megan




More information about the Snort-users mailing list