[Snort-users] PulledPork puts empty snort.rules file in rules dir

codeforfun codeforfun at ...10619...
Tue Nov 22 14:44:44 EST 2011


I am using PulledPork 0.6.1 on Windows XP to update my snort rules.

I have managed to get PulledPork to download the rules to a tmp dir on 
my local computer ("snortrules-snapshot-2900.tar.gz"). With the file 
size of 27,091KB

But when it comes to updating the c:\snort\rules dir, it only seems to 
place one empty file into this dir, the file is called "snort.rules" 
file size 0KB.

Could someone please point me in the right direction to how i can solve 
this issue?

I have also attached my snort.conf and pulledpork.conf
This is the command i am using to run PulledPork = "pulledpork.pl -c 
./etc/pulledpork.conf -v"

I have been working on this for around 3days now. I have also read the 
pulledpork "README" file and the "snort\doc\README.*" files. But i 
really need some more help.


The output from PulledPork looks like this:

Setting Flowbit State....
         Done
Writing C:\snort\rules\snort.rules....
         Done
Generating sid-msg.map....
         Done
Writing C:\snort\sid-msg.map....
         Done
Writing C:\snort\sid_changes.log....
         Done
Rule Stats....
         New:-------0
         Deleted:---0
         Enabled Rules:----0
         Dropped Rules:----0
         Disabled Rules:---0
         Total Rules:------0
         Done
Please review C:\snort\sid_changes.log for additional details
Fly Piggy Fly!



CodeForFun
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: snort.conf
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20111122/56b2f3f4/attachment.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: pulledpork.conf
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20111122/56b2f3f4/attachment-0001.ksh>


More information about the Snort-users mailing list