On Sat, 25 Dec 2004, Rich Adamson wrote:
1. There seems to be two ways to specify a url for fetching rule
updates. One from the command line with the -u switch, and a second
by specifing the url in the oinkmaster.conf file. Is that a correct
assumption?
Yes, and there is no difference between them. If url is specified both on
command line and in the config file, command line wins.
2. Can the oinkmaster.conf file contain both url's (eg, will both the
snort.org and bleedingsnort.com rules be updated)?
No, you'll have to run Oinkmaster once for each url (there are reasons
for this), either by using separate config files or different
-u arguments. Also see Q23 in the FAQ at
http://cvs.sourceforge.net/viewcvs.py/oinkmaster/oinkmaster/FAQ?view=markup
3. Until I get some experience with oinkmaster, I've simply set up a
shortcut on the desktop to execute the perl scripts for updating. When
I'm more comfortable with the results, I'll schedule it via the equiv
of a cron job. It would appear the snort.org rules for v2.2 are not
actually updated on their web site on a regular basis even though
their file is rebuilt daily. Is that a correct assumption?
Just because the tarball is rebuilt doesn't always mean the rules
in it have changed, but that doesn't matter. Just run Oinkmaster once a
day or so and it will tell you if anything changed. You could always
verify with the cvs that you have the latest stuff.
Also see Q19 in the FAQ.
4. What's the proper way to handle bleeding-sid-msg.map file using
oinkmaster? (For now, I manually copy/pasted the contents into the
etc/sid-msg.map file. I'm assuming there is a better way to handle
that via oinkmaster.)
There are many ways to do that. One way is to ignore the default sid
maps and generate one yourself by using create-sidmap.pl (found
in Oinkmaster's contrib directory) after each update.
More info is in Q23 in the FAQ.
/Andreas
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
