<html>

<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered)">
<base href="x-msg://159/">
<style>
<!--
 /* Font Definitions */
 @font-face
        {font-family:Helvetica;
        panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:blue;
        text-decoration:underline;}
span.EmailStyle19
        {font-family:Arial;
        color:blue;
        font-weight:normal;
        font-style:normal;
        text-decoration:none none;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body lang=EN-CA link=blue vlink=blue style='word-wrap: break-word;-webkit-nbsp-mode: space;
-webkit-line-break: after-white-space'>

<div class=Section1>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>Hi,</span></font></p>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>What I posted was basically the output,
minus the stuff about so_rules and local paths.  I can post more if JJ would
like it.</span></font></p>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>Thanks</span></font></p>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>Shawn</span></font></p>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<div>

<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>

<hr size=2 width="100%" align=center tabindex=-1>

</span></font></div>

<p class=MsoNormal><b><font size=2 face=Tahoma><span lang=EN-US
style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma'>
Joel Esler [mailto:jesler@...1935...] <br>
<b><span style='font-weight:bold'>Sent:</span></b> Wednesday, June 30, 2010
4:44 PM<br>
<b><span style='font-weight:bold'>To:</span></b> Jefferson, Shawn<br>
<b><span style='font-weight:bold'>Cc:</span></b> Crook, Parker;
snort-users@lists.sourceforge.net<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Snort-users] rule
download problem</span></font></p>

</div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mine worked fine.  Can you send the output of pulledpork ran with
-vv on it?  Maybe JJ can chime in a bit later.  </span></font></p>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>On Jun 30, 2010, at 7:39 PM, Jefferson, Shawn wrote:</span></font></p>

</div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><br>
<br>
</span></font></p>

<span style='orphans: 2;widows: 2;-webkit-border-horizontal-spacing: 0px;
-webkit-border-vertical-spacing: 0px;-webkit-text-decorations-in-effect: none;
-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:
0px'>

<div link=blue vlink=blue style='word-wrap: break-word;-webkit-nbsp-mode: space;
-webkit-line-break: after-white-space'>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>Hi,</span></font></p>

</div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>No, this is a new installation.  I am
using Oinkmaster but thought this might be a good opportunity to upgrade to
pulled pork.  A packet capture shows the download of the md5 working
properly, but the download of the rules file gets a 302 redirect, and then
nothing else.  Pulled Pork doesn’t follow the redirect maybe?</span></font></p>

</div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<div>

<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>

<hr size=2 width="100%" align=center tabindex=-1>

</span></font></div>

<div>

<p class=MsoNormal><b><font size=2 face=Tahoma><span lang=EN-US
style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><span
class=apple-converted-space><font size=2 face=Tahoma><span lang=EN-US
style='font-size:10.0pt;font-family:Tahoma'> </span></font></span><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma'>Joel
Esler [mailto:jesler@...1935...]<span class=apple-converted-space> </span><br>
<b><span style='font-weight:bold'>Sent:</span></b><span
class=apple-converted-space> </span>Wednesday, June 30, 2010 4:36 PM<br>
<b><span style='font-weight:bold'>To:</span></b><span
class=apple-converted-space> </span>Jefferson, Shawn<br>
<b><span style='font-weight:bold'>Cc:</span></b><span
class=apple-converted-space> </span>Crook, Parker;<span
class=apple-converted-space> </span><a
href="mailto:snort-users@lists.sourceforge.net">snort-users@...4137...orge.net</a><br>
<b><span style='font-weight:bold'>Subject:</span></b><span
class=apple-converted-space> </span>Re: [Snort-users] rule download
problem</span></font></p>

</div>

</div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Are you using the pulledpork.conf file from your old pulledpork
installation?</span></font></p>

</div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

</div>

<div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Can't do that.</span></font></p>

</div>

</div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

</div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

<div>

<div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>On Jun 30, 2010, at 7:31 PM, Jefferson, Shawn wrote:</span></font></p>

</div>

</div>

<div>

<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'> </span></font></p>

</div>

<span style='orphans: 2;widows: 2;-webkit-border-horizontal-spacing: 0px;
-webkit-border-vertical-spacing: 0px;-webkit-text-decorations-in-effect: none;
-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:
0px'>

<div link=blue vlink=blue>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>What was the solution to this? I’m trying
to setup Pulled Pork using the new download location and am getting the same
error (501) when trying to download the tar.gz file.</span></font></p>

</div>

</div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>Checking latest MD5....</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>       
Fetching md5sum for: snortrules-snapshot-2853.tar.gz.md5</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>       
most recent rules file digest: aa012e45a5756acabb0e8c31e862f336</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>Rules tarball download....</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>       
Fetching rules file: snortrules-snapshot-2853.tar.gz</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>       
Error 501 when fetching snortrules-snapshot-2853.tar.gz at ./pulledpork.pl line
261.</span></font></p>

</div>

</div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>Do I have the right settings?</span></font></p>

</div>

</div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>       
rule_file = snortrules-snapshot-2853.tar.gz</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>       
base_url =<span class=apple-converted-space> </span><a
href="http://www.snort.org/sub-rules">http://www.snort.org/sub-rules</a></span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'>       
version = 0.4.2</span></font></p>

</div>

</div>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<p class=MsoNormal><font size=2 color=blue face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:blue'> </span></font></p>

<div>

<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>

<hr size=2 width="100%" align=center tabindex=-1>

</span></font></div>

<div>

<div>

<p class=MsoNormal><b><font size=2 face=Tahoma><span lang=EN-US
style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><span
class=apple-converted-space><font size=2 face=Tahoma><span lang=EN-US
style='font-size:10.0pt;font-family:Tahoma'> </span></font></span><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma'>Crook,
Parker [mailto:Parker_Crook@...14786...]<span class=apple-converted-space> </span><br>
<b><span style='font-weight:bold'>Sent:</span></b><span
class=apple-converted-space> </span>Tuesday, June 29, 2010 8:35 AM<br>
<b><span style='font-weight:bold'>To:</span></b><span
class=apple-converted-space> </span>'JJC'; John York<br>
<b><span style='font-weight:bold'>Cc:</span></b><span
class=apple-converted-space> </span><a
href="mailto:snort-users@lists.sourceforge.net">snort-users@...4137...orge.net</a><br>
<b><span style='font-weight:bold'>Subject:</span></b><span
class=apple-converted-space> </span>Re: [Snort-users] rule download
problem</span></font></p>

</div>

</div>

</div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>JJ,</span></font></p>

</div>

</div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>I’ve waited the morning
out to see if this would clear up, but I’ve been ping-ponging back and forth
between 501 and 403 errors when using the Pulled Pork svn to try and download
the new rules.  Below is the verbose output… any words of advice here?</span></font></p>

</div>

</div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>snort-lab:/etc/snort/pulledpork#
./pulledpork.pl -c etc/pulledpork.conf -vv</span></font></p>

</div>

</div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>   <span
class=apple-converted-space> </span><a
href="http://code.google.com/p/pulledpork/">http://code.google.com/p/pulledpork/</a></span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>     
_____ ____</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>    
`----,\    )</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>     
`--==\\  /    Pulled_Pork v0.4.2</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>      
`--==\\/</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>    
.-~~~~-.Y|\\_  Copyright (C) 2009-2010 JJ Cummings</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'> 
@_/        /  66\_ <span
class=apple-converted-space> </span><a href="mailto:cummingsj@...391...1827...">cummingsj@...11827...</a></span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>   
|    \   \   _(")</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>    
\   /-| ||'--'  Rules give me wings!</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>     
\_\  \_\\</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span></font></p>

</div>

</div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>Command Line Variable
Debug:</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
Config Path is: etc/pulledpork.conf</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
Verbose Flag is Set</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
Extra Verbose Flag is Set</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>Config File Variable
Debug etc/pulledpork.conf</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
snort_path = /usr/local/bin/snort</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
pid_path = /var/run/snort_eth0.pid</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
rule_path = /etc/snort/rules/snort.rules</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
ignore = deleted,experimental,local</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
rule_file = snortrules-snapshot-2860.tar.gz</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
sid_changelog = /var/log/sid_changes.log</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
sid_msg = /etc/snort/sid-msg.map</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>      
 config_path = /etc/snort/snort.conf</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
sostub_path = /etc/snort/rules/so_rules.rules</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
oinkcode = <oinkcode obfuscated></span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
temp_path = /tmp</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
distro = Debian-Lenny</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
base_url =<span class=apple-converted-space> </span><a
href="http://www.snort.org/">http://www.snort.org/</a></span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
sorule_path = /usr/local/lib/snort_dynamicrules/</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
version = 0.4.2</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
disablesid = /usr/local/etc/snort/disablesid.conf</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
local_rules = /etc/snort/rules/local.rules</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>Checking latest MD5....</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
Fetching md5sum for: snortrules-snapshot-2860.tar.gz.md5</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
most recent rules file digest: b3cb777fac21999675e8cf5696865fa5</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
current local rules file  digest: 4a7877208481756881a66f7cadcff98b</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
The MD5 for snortrules-snapshot-2860.tar.gz did not match the latest digest...
so I am gonna fetch the latest rules file!</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>Rules tarball
download....</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
Fetching rules file: snortrules-snapshot-2860.tar.gz</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>       
Error 501 when fetching snortrules-snapshot-2860.tar.gz at ./pulledpork.pl line
262.</span></font></p>

</div>

</div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=2 color=navy face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;color:navy'>-Parker</span></font></p>

</div>

</div>

<div>

<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>

<hr size=2 width="100%" align=center tabindex=-1>

</span></font></div>

<div>

<div>

<p class=MsoNormal><b><font size=2 face=Tahoma><span lang=EN-US
style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><span
class=apple-converted-space><font size=2 face=Tahoma><span lang=EN-US
style='font-size:10.0pt;font-family:Tahoma'> </span></font></span><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma'>JJC
[mailto:cummingsj@...11827...]<span class=apple-converted-space> </span><br>
<b><span style='font-weight:bold'>Sent:</span></b><span
class=apple-converted-space> </span>Tuesday, June 29, 2010 10:32 AM<br>
<b><span style='font-weight:bold'>To:</span></b><span
class=apple-converted-space> </span>John York<br>
<b><span style='font-weight:bold'>Cc:</span></b><span
class=apple-converted-space> </span><a
href="mailto:snort-users@lists.sourceforge.net">snort-users@...4137...orge.net</a><br>
<b><span style='font-weight:bold'>Subject:</span></b><span
class=apple-converted-space> </span>Re: [Snort-users] rule download
problem</span></font></p>

</div>

</div>

</div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'> </span></font></p>

<div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>The rule download location has changed, you will want
to get the latest version of pulledpork from svn (0.4.2) or wait until the
tarball is released shortly.</span></font></p>

</div>

</div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'> </span></font></p>

</div>

<div>

<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>JJC</span></font></p>

<div>

<div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>On Tue, Jun 29, 2010 at 7:25 AM, John York <<a
href="mailto:YorkJ@...7109...">YorkJ@...7109...</a>> wrote:</span></font></p>

</div>

</div>

<div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>I've been using PulledPork (v 0.4.1 Stumbling
Leprechaun) to get my rules, but in the last week or so it has started giving
this error:<br>
Error 403 when fetching<span class=apple-converted-space> </span><a
href="http://www.snort.org/pub-bin/oinkmaster.cgi/snortrules-snapshot-2860_s.tar.gz.md5"
target="_blank">http://www.snort.org/pub-bin/oinkmaster.cgi/snortrules-snapshot-2860_s.tar.gz.md5</a><span
class=apple-converted-space> </span>at /home/xxxx/snortrules/pulledpork/<a
href="http://pulledpork.pl" target="_blank">pulledpork.pl</a><span
class=apple-converted-space> </span>line 306<br>
<br>
It does this even if I wait several hours between attempts, so I don't think
the 15 min limit is involved.<br>
<br>
These are the applicable lines from the conf file:<br>
base_url=<a href="http://www.snort.org/pub-bin/oinkmaster.cgi" target="_blank">http://www.snort.org/pub-bin/oinkmaster.cgi</a><br>
rule_file=snortrules-snapshot-2860_s.tar.gz<br>
<br>
My subscription is up to date--I can log in to the web site and download the
rules ok.  Any ideas?<br>
<br>
Thanks<br>
John<br>
<br>
<br>
------------------------------------------------------------------------------<br>
This<span class=apple-converted-space> </span><a href="http://SF.net">SF.net</a><span
class=apple-converted-space> </span>email is sponsored by Sprint<br>
What will you do first with EVO, the first 4G phone?<br>
Visit<span class=apple-converted-space> </span><a
href="http://sprint.com/first" target="_blank">sprint.com/first</a><span
class=apple-converted-space> </span>--<span class=apple-converted-space> </span><a
href="http://p.sf.net/sfu/sprint-com-first" target="_blank">http://p.sf.net/sfu/sprint-com-first</a><br>
_______________________________________________<br>
Snort-users mailing list<br>
<a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@...4626...ceforge.net</a><br>
Go to this URL to change user options or unsubscribe:<br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-users"
target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
Snort-users list archive:<br>
<a href="http://www.geocrawler.com/redir-sf.php3?list=snort-users"
target="_blank">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a></span></font></p>

</div>

</div>

</div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'> </span></font></p>

</div>

<div>

<p class=MsoNormal><font size=4 face=Helvetica><span style='font-size:13.5pt;
font-family:Helvetica'>------------------------------------------------------------------------------<br>
This<span class=apple-converted-space> </span><a href="http://SF.net">SF.net</a><span
class=apple-converted-space> </span>email is sponsored by Sprint<br>
What will you do first with EVO, the first 4G phone?<br>
Visit<span class=apple-converted-space> </span><a
href="http://sprint.com/first">sprint.com/first</a><span
class=apple-converted-space> </span>--<span class=apple-converted-space> </span><a
href="http://p.sf.net/sfu/sprint-com-first_______________________________________________">http://p.sf.net/sfu/sprint-com-first_______________________________________________</a><br>
Snort-users mailing list<br>
<a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@...4626...ceforge.net</a><br>
Go to this URL to change user options or unsubscribe:<br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
Snort-users list archive:<br>
<a href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a></span></font></p>

</div>

</div>

</div>

</span>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

</div>

</div>

</div>

</span>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

</div>

</div>

</body>

</html>