SnortSam 2.x recall

[Frank Knobbe <fknobbe () knobbeits com>]

I'm sorry to have to push this through the Snort list again. We'll be
setting up a SnortSam mail list in the near future. However, I think
this message is important enough to pass through once more.


SnortSam, which allows Snort to block on Checkpoint and Cisco firewalls
as well as Cisco routers, comes in two flavors. The version 1.45.2.4 is
the current single-threaded version and version 2.8 is the current
multi-threaded version. Or at least was... 

I'm officially recalling any version 2.x as there seems to be a bug in
it that causes SnortSam under certain conditions to only block the first
request. Any subsequent requests are processed and logged, but no
blocking occurs. (I'm pulling my hair out over this).

Anyhow, until this issue is fixed, I would like to ask everyone using
SnortSam to use version 1.45.2.4. It is currently maintained in parallel
with the 2.x version and does receive bug fixes. The only difference is
in the threading. So please discard all 2.x version for a while (unless
you want to assist in troubleshooting) and use 1.45.2.4 instead.

I'll update the website and release binaries as soon as the issue in 2.x
is found and fixed.


Thanks,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part