Re: Oinkmaster v1.1 questions

[Andreas Östling <andreaso () it su se>]

On Sat, 25 Dec 2004, Rich Adamson wrote:

> 1. There seems to be two ways to specify a url for fetching rule
> updates. One from the command line with the -u switch, and a second
> by specifing the url in the oinkmaster.conf file. Is that a correct
> assumption?

Yes, and there is no difference between them. If url is specified both on 
command line and in the config file, command line wins.

 
> 2. Can the oinkmaster.conf file contain both url's (eg, will both the
> snort.org and bleedingsnort.com rules be updated)?

No, you'll have to run Oinkmaster once for each url (there are reasons 
for this), either by using separate config files or different 
-u arguments. Also see Q23 in the FAQ at
http://cvs.sourceforge.net/viewcvs.py/oinkmaster/oinkmaster/FAQ?view=markup


> 3. Until I get some experience with oinkmaster, I've simply set up a
> shortcut on the desktop to execute the perl scripts for updating. When
> I'm more comfortable with the results, I'll schedule it via the equiv
> of a cron job. It would appear the snort.org rules for v2.2 are not
> actually updated on their web site on a regular basis even though 
> their file is rebuilt daily. Is that a correct assumption? 

Just because the tarball is rebuilt doesn't always mean the rules 
in it have changed, but that doesn't matter. Just run Oinkmaster once a 
day or so and it will tell you if anything changed. You could always 
verify with the cvs that you have the latest stuff.
Also see Q19 in the FAQ.


> 4. What's the proper way to handle bleeding-sid-msg.map file using
> oinkmaster? (For now, I manually copy/pasted the contents into the
> etc/sid-msg.map file. I'm assuming there is a better way to handle
> that via oinkmaster.)

There are many ways to do that. One way is to ignore the default sid 
maps and generate one yourself by using create-sidmap.pl (found 
in Oinkmaster's contrib directory) after each update.
More info is in Q23 in the FAQ.

/Andreas


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users