<div dir="ltr">When I try using the conf file that you linked from google code and run:<p class="">sudo <a href="http://pulledpork.pl">pulledpork.pl</a> -c /etc/pulledpork/pulledpork.conf</p><p class="">I get an error:</p>
<p class="">You are not using the current version of pulledpork.conf!</p><p class="">








</p><p class="">Please use the version that shipped with PulledPork v0.7.0 - Swine Flu!!</p></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Aug 29, 2014 at 3:14 PM, Matt M. <span dir="ltr"><<a href="mailto:mr10001@...11827..." target="_blank">mr10001@...14542....</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Now I receive a 422 error:<div><br></div><div><div class="">







<p>Checking latest MD5 for snortrules-snapshot-2962.tar.gz....</p>
</div><p><span>       </span>Error 422 when fetching <a href="http://www.snort.org/reg-rules/snortrules-snapshot-2962.tar.gz.md5" target="_blank">http://www.snort.org/reg-rules/snortrules-snapshot-2962.tar.gz.md5</a> at /usr/local/bin/<a href="http://pulledpork.pl" target="_blank">pulledpork.pl</a> line 463.</p>


<p><span>   </span>main::md5file('<oinkcode>', 'snortrules-snapshot-2962.tar.gz', '/tmp/', '<a href="http://www.snort.org/reg-rules/" target="_blank">http://www.snort.org/reg-rules/</a>') called at /usr/local/bin/<a href="http://pulledpork.pl" target="_blank">pulledpork.pl</a> line 1847</p>

</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Aug 29, 2014 at 3:11 PM, Y M <span dir="ltr"><<a href="mailto:snort@...15979..." target="_blank">snort@...15979...</a>></span> wrote:<br>

<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">


<div><div dir="ltr"><div>Date: Fri, 29 Aug 2014 15:08:08 -0500<br>Subject: Re: [Snort-users] Pulled Pork 404 Errors?<br>From: <a href="mailto:mr10001@...11827..." target="_blank">mr10001@...11827...</a><br>To: <a href="mailto:snort@...15979..." target="_blank">snort@...15979...</a><br>

CC: <a href="mailto:snort-users@lists.sourceforge.net" target="_blank">snort-users@lists.sourceforge.net</a><br><br><div dir="ltr"><div>You bet:<div><br></div><div>This is what I have...</div><div><br></div><div>
<div>rule_url=<a href="http://www.snort.org/rules/%7csnortrules-snapshot.tar.gz%7c" target="_blank">http://www.snort.org/rules/|snortrules-snapshot.tar.gz|</a><oinkcode></div>
</div><div><br></div><div><br></div></div><div>Ok, I am not familiar with brew packages, but the URL above may be wrong. Replace the "/rules/" with "/reg-rules/" and try again. From the original pulledpork.conf: <a href="https://code.google.com/p/pulledpork/source/browse/trunk/etc/pulledpork.conf" style="font-size:12pt" target="_blank">https://code.google.com/p/pulledpork/source/browse/trunk/etc/pulledpork.conf</a></div>

</div><span><font color="#888888"><div><br></div></font></span><div><span><font color="#888888">YM</font></span><div><div><br><br><div>On Fri, Aug 29, 2014 at 3:05 PM, Y M <span dir="ltr"><<a href="mailto:snort@...979...15979..." target="_blank">snort@...15979...</a>></span> wrote:<br>


<blockquote style="border-left:1px #ccc solid;padding-left:1ex">


<div><div dir="ltr">Date: Fri, 29 Aug 2014 14:37:46 -0500<br>From: <a href="mailto:mr10001@...11827..." target="_blank">mr10001@...11827...</a><br>To: <a href="mailto:snort-users@lists.sourceforge.net" target="_blank">snort-users@lists.sourceforge.net</a><br>


Subject: [Snort-users] Pulled Pork 404 Errors?<br><br><div dir="ltr"><div>Total Noob Here,<div><br></div><div>I'm receiving the following error and cannot seem to figure out how to resolve it:</div></div><div>
<div>







>Checking latest MD5 for snortrules-snapshot-2962.tar.gz....<br>
<span></span>>A 404 error occurred, please verify your filenames and urls for your tarball!<br>
<span></span>>Error 404 when fetching <a href="https://www.snort.org/rules/snortrules-snapshot-2962.tar.gz.md5" target="_blank">https://www.snort.org/rules/snortrules-snapshot-2962.tar.gz.md5</a> at /usr/local/bin/<a href="http://pulledpork.pl" target="_blank">pulledpork.pl</a> line 463.<br>


<br><br></div>Can you post the "rule_url" from your pulledpork.conf? (without your oinkcode).<div><br><br><br>

<span></span>>main::md5file('<oinkcode>', 'snortrules-snapshot-2962.tar.gz', '/tmp/', '<a href="https://www.snort.org/rules/" target="_blank">https://www.snort.org/rules/</a>') called at /usr/local/bin/<a href="http://pulledpork.pl" target="_blank">pulledpork.pl</a> line 1847<br>



<br><br>I'm on OSX and used brew to install snort and pulled pork v0.7.0.  I've tried modifying both the <a href="http://pullpork.pl" target="_blank">pullpork.pl</a> and conf file to adjust the url's by removing the ...org/reg-rules/ and change it to ...org/rules/ and even tried to remove the "S" from HTTPS in the url's as well.<br>



I'm I even in the right ballpark?<br>Thanks for any assistance with this,<br><div><br></div>-- <br><div dir="ltr">M, CISSP, GCFE, GCFA<br><br><b>“</b><span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-style:italic;line-height:20px">To disagree leads to study, to study leads to understanding, to understand is to appreciate, to appreciate is to love. So maybe I’ll end up loving your theory.<b>”</b> -</span><em style="border:0px;padding:0px;vertical-align:baseline;color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;line-height:20px">John Wheeler</em><br>



</div>
</div></div></div>
<br>------------------------------------------------------------------------------
Slashdot TV.  
Video for Nerds.  Stuff that matters.
<a href="http://tv.slashdot.org/" target="_blank">http://tv.slashdot.org/</a><br>_______________________________________________
Snort-users mailing list
<a href="mailto:Snort-users@lists.sourceforge.net" target="_blank">Snort-users@lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a href="https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users</a> list archive:
<a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a>

Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!                                      </div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Matt M., CISSP, GCFE, GCFA<br><br><b>“</b><span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-style:italic;line-height:20px">To disagree leads to study, to study leads to understanding, to understand is to appreciate, to appreciate is to love. So maybe I’ll end up loving your theory.<b>”</b> -</span><em style="border:0px;padding:0px;vertical-align:baseline;color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;line-height:20px">John Wheeler</em><br>


</div>
</div></div></div></div>                                          </div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Matt M., CISSP, GCFE, GCFA<br><br><b>“</b><span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-style:italic;line-height:20px">To disagree leads to study, to study leads to understanding, to understand is to appreciate, to appreciate is to love. So maybe I’ll end up loving your theory.<b>”</b> -</span><em style="border:0px;margin:0px;outline:0px;padding:0px;vertical-align:baseline;color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;line-height:20px">John Wheeler</em><br>

</div>
</div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Matt M., CISSP, GCFE, GCFA<br><br><b>“</b><span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-style:italic;line-height:20px">To disagree leads to study, to study leads to understanding, to understand is to appreciate, to appreciate is to love. So maybe I’ll end up loving your theory.<b>”</b> -</span><em style="border:0px;margin:0px;outline:0px;padding:0px;vertical-align:baseline;color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;line-height:20px">John Wheeler</em><br>
</div>
</div>