Re: so_rules - only small subset compiling and usable

[Matthew Watchinski <mwatchinski () sourcefire com>]

Do the pre-compiled rules for Ubuntu not work for you?  Should be 
similar platform.

Cheers,
-matt

chris ryan wrote:
> Hi,
>
> i've just compiled the so-rules with snort 2.8.2.1 from the latest
> tarball (registered users release) without any errors.
> I have to compile the rules myself because the precompiled libaries are
> not available for my platform (Debian Lenny, Snort 2.8.2.1 from source [1]).
>
> One thing is odd:
> The rule count for the precompiled libraries is > 80.
>
> Not matter what i do, when i compile the so_rules myself,
> i've only 22 rules in the generated stub rule files.
>
> Also, the precompiled libaries are more that twice as big at the disk.
> So in effect, i can only use a subset of 22 rules.
>
> Can anybody give me a hint what's my mistake?
>
>
>
> Thanks in advance, Chris.
>
>
> [1] compile options:
>  ./configure --prefix=/usr --bindir=/usr/bin --sysconfdir=/etc/snort
> --enable-pthread --enable-rulestate --enable-dynamicplugin
> --enable-timestats --enable-perfprofiling --enable-linux-smp-stats
> --enable-snmp --with-mysql=/usr/share/mysql
> --with-mysql-libraries=/usr/lib --with-mysql-includes=/usr/include/mysql
> -with-postgresql=/usr/share/postgresql
> --with-libpq-includes=/usr/include/postgres
> --with-libpq-libraries=/usr/lib/postgresql --enable-dynamicplugin
> --enable-decoder-preprocessor-rules --enable-ppm
> --with-libpcap-includes=/usr/local/src/libpcap
> --with-libpcap-libaries=/usr/local/src/libpcap/.libs
>
>
>
>
>
>
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users