Snort mailing list archives

rules update schedule (was: Re: so_rule problem)


From: waldo kitty <wkitty42 () windstream net>
Date: Fri, 01 Oct 2010 13:35:59 -0400

On 10/1/2010 13:14, Nigel Houghton wrote:
On Fri, 01 Oct 2010 12:37:14 -0400, waldo kitty wrote:
i had similar discussion to this some time back in another venue and
at that time the question was does VRT update the "registered" rules
snapshot every day so that there's a "rolling release" or do they
simply wait and do one release every 30 days... AIR, no one ever
answered that question or provided a pointer to where it might be
answered...

Didn't see that question, but to answer it. The roll over is automatic.

yeah, i think it was before i joined the SF lists so you're off the hook :P

i guess what i'm really trying to dig out is the answers to the following 
questions...

1. are rules released daily or are they held and released in batches once a week 
or month?

2. can you list possible reasons why an initial update connection may be 403'd 
and the 15 minute delay initiated?

3. is it possible that even after waiting out the 15 minute delay that one might 
be 403'd again?

4. will we see the return of the reason for the 403 and the try again in X 
minutes in the 403 messages or will they remain plain jane 403's with no 
information that can be passed back to the user via message or logs?

the answers could greatly help with eliminating unnecessary updating schedules 
and traffic...

thanks for your time and attention in this! ;)

------------------------------------------------------------------------------
Start uncovering the many advantages of virtual appliances
and start using them to simplify application deployment and
accelerate your shift to cloud computing.
http://p.sf.net/sfu/novell-sfdev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: