<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Most likely you can just update to the latest version of snort (PP reads what you have and attempts to retrieve the supporting rule set version)<br><br>Sent from the iRoad</div><div><br>On Feb 3, 2013, at 16:55, Joel Esler <<a href="mailto:jesler@...14156......">jesler@...1935...</a>> wrote:<br><br></div><blockquote type="cite"><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div>You are attempting to download 2852.  Which had been eol'ed for years.  </div><div><br></div><div>Change that to 2940 and you'll get the latest ruleset. <br><br><div>--</div><div><b>Joel Esler</b></div>Sent from my iPhone <span style="background-color: rgba(255, 255, 255, 0);"></span></div><div><br>On Feb 3, 2013, at 6:39 PM, Dan Rossiter <<a href="mailto:dan.rossiters@...11827...">dan.rossiters@...5119...827...</a>> wrote:<br><br></div><blockquote type="cite"><div>In running pulledpork, I'm getting a 403 error downloading the snortrules-snapshot tarball. All the other files (opensource & emerging.rules) download without a problem after I comment out the snapshot line.<br><br>

Is this a known issue? Any suggestions on how to resolve? Obviously the oinkcode is correct since the other files worked and the tarball name is simply the name pre-included in the config file.<br><br>The specific error being throws is the following:<br>

<br>Checking latest MD5 for snortrules-snapshot-2852.tar.gz....<br>        A 403 error occurred, please wait for the 15 minute timeout<br>        to expire before trying again or specify the -n runtime switch<br>        You may also wish to verfiy your oinkcode, tarball name, and other configuration options<br>

        Error 403 when fetching <a href="https://www.snort.org/reg-rules/snortrules-snapshot-2852.tar.gz.md5">https://www.snort.org/reg-rules/snortrules-snapshot-2852.tar.gz.md5</a> at pulledpork/<a href="http://pulledpork.pl">pulledpork.pl</a> line 453<br>

        main::md5file('<oinkcode here>', 'snortrules-snapshot-2852.tar.gz', '/tmp/', '<a href="https://www.snort.org/reg-rules/">https://www.snort.org/reg-rules/</a>') called at pulledpork/<a href="http://pulledpork.pl">pulledpork.pl</a> line 1758<br>

<br>-Dan<br>
</div></blockquote><blockquote type="cite"><div><span>------------------------------------------------------------------------------</span><br><span>Everyone hates slow websites. So do we.</span><br><span>Make your web apps faster with AppDynamics</span><br><span>Download AppDynamics Lite for free today:</span><br><span><a href="http://p.sf.net/sfu/appdyn_d2d_jan">http://p.sf.net/sfu/appdyn_d2d_jan</a></span></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Snort-users mailing list</span><br><span><a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a></span><br><span>Go to this URL to change user options or unsubscribe:</span><br><span><a href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a></span><br><span>Snort-users list archive:</span><br><span><a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a></span><br><span></span><br><span>Please visit <a href="http://blog.snort.org">http://blog.snort.org</a> to stay current on all the latest Snort news!</span></div></blockquote></div></blockquote><blockquote type="cite"><div><span>------------------------------------------------------------------------------</span><br><span>Everyone hates slow websites. So do we.</span><br><span>Make your web apps faster with AppDynamics</span><br><span>Download AppDynamics Lite for free today:</span><br><span><a href="http://p.sf.net/sfu/appdyn_d2d_jan">http://p.sf.net/sfu/appdyn_d2d_jan</a></span></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Snort-users mailing list</span><br><span><a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a></span><br><span>Go to this URL to change user options or unsubscribe:</span><br><span><a href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a></span><br><span>Snort-users list archive:</span><br><span><a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a></span><br><span></span><br><span>Please visit <a href="http://blog.snort.org">http://blog.snort.org</a> to stay current on all the latest Snort news!</span></div></blockquote></body></html>