[Snort-users] trying this again (UNCLASSIFIED)

beenph beenph at ...11827...
Fri Dec 14 20:18:26 EST 2012

On Fri, Dec 14, 2012 at 11:42 AM, Cass, Mark A CTR (US) <
mark.a.cass2.ctr at ...16010...> wrote:
> Classification: UNCLASSIFIED
> Caveats: NONE
> Thank you for the reply.
> Let me see if I got this straight...
Unfortunaly i think some things where not understood properly and i will
try to reclarify them.

> I'll need to specify the -f option for barnyard2 and tell it the prefix
naming convention of the files it needs to input to log to mysql database?

Yes if in your snort.conf file you have output unified2: filename
snort.log, limit 128

Then the barnyard2 -f argument needs to be snort.log

> The reason for the barnyard2 aborting was because the test rule did not
have a "rev:xxx" at the top >of the text file?

Not at the top of the file but in the rule body of your test rule

icmp any any -> any any (msg:"blabla test rule"; sid:100000001;)

Should have been
icmp any any -> any any (msg:"blabla test rule"; sid:100000001; rev:1;)
|---------------RULE BODY-------------------|

>So when I downloaded the new rules from pulled pork, and commented out the
test rule, should the rules downloaded from pulled pork not have had a
revision with it already?
>I'm going to have to go into a thousand files >and manually add
>"rev:(some number)" to them all in order for it to work?
>That seems really ridiculous.  And would I have to do this manually every
time the rules are updated?
> The last thing about the -G and -S options, I'm totally lost.  I'm just
running it how the guide told me to, with those options.  You're saying
that at this point, the -G -S options are not allowing barnyard2 to write
the data to mysql?
> Thank you,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20121214/59a29c6b/attachment.html>

More information about the Snort-users mailing list