Snort mailing list archives
Re: blacklist vs black_list :: pulledpork overwrites the files with a list of IP addresses
From: "Steve Crow" <scrow () amarilloheartgroup com>
Date: Wed, 4 Jun 2014 15:31:44 -0500
Thank you, that was helpful, I have modified my reputaion list file name. Steve -----Original Message----- From: waldo kitty [mailto:wkitty42 () windstream net] Sent: Wednesday, May 28, 2014 9:37 PM To: snort-users () lists sourceforge net Subject: Re: [Snort-users] blacklist vs black_list :: pulledpork overwrites the files with a list of IP addresses On 5/28/2014 4:47 PM, Steve Crow wrote:
Pulledpork is overwriting my blacklist.rules or black_list.rules files that normally has rules in it with a list IP addresses. Whichever is listed in snort.conf gets overwritten. Why are there two similarly named rules files. What are their proper uses. How does it need to be specified in snort.conf so that pulledpork doesn't overwrite the rules with IP addresses?
the one named in the reputation blacklist/whitelist section is the one that should have IP addresses in it... the other one is the one with rules in it... FWIW: this came up about a year+ ago... at that time, i suggested to VRt that they rename the reputation blacklist/whitelist files to RP_whitelist and RP_blacklist specifically so denote them being related to the reputation processor... i recommend you do the same now and leave the other one named as it is... i don't recall which is which but your snort.conf will tell you ;) -- NOTE: No off-list assistance is given without prior approval. Please *keep mailing list traffic on the list* unless private contact is specifically requested and granted. ---------------------------------------------------------------------------- -- Time is money. Stop wasting it! Get your web API in 5 minutes. www.restlet.com/download http://p.sf.net/sfu/restlet _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/NeoTech _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- blacklist vs black_list :: pulledpork overwrites the files with a list of IP addresses Steve Crow (May 28)
- Re: blacklist vs black_list :: pulledpork overwrites the files with a list of IP addresses waldo kitty (May 28)
- Re: blacklist vs black_list :: pulledpork overwrites the files with a list of IP addresses Steve Crow (Jun 04)
- Re: blacklist vs black_list :: pulledpork overwrites the files with a list of IP addresses waldo kitty (May 28)