Re: snortsam patch for snort 2.9.2.2

[Michael Scheidell <michael.scheidell () secnap com>]

On 4/9/12 12:51 PM, Robert Z wrote:
> Hi all,
>
> This is a snortsam patch for snort 2.9.2.2 that I did this morning. 
> This was tested on a Ubuntu machine, no build issues.
>
> Michael if this works out for you, ask Frank to upload this file to 
> snortsam.net.
make -DWITH_SNORTSAM works with a patch to FreeBSD port (ie: patch 
applies cleanly)
running in a tinderbox right now.

seems to work:  I will open a pr for it and ask Frank to host it.

2012/04/09, 15:03:44, 127.0.0.1, 2, snortsam, Blocking host 
222.186.12.162 completely for 86400 seconds (Sig_ID: 2010935).

pfw table 3 list | grep 222.186.12.162
222.186.12.162/32 0


Thanks Robert.

ps, anyone with FreeBSD anxious to test it, update your ports tree, and 
then apply this patch to ../security/snort:

http://people.freebsd.org/~scheidell/snort.patch

(I would do this:  mostly makes sense if you are running the older one 
with snortsam output in snort.conf:

cd /usr/ports/security/snort
curl http://people.freebsd.org/~scheidell/snort.patch | patch -EuIN && 
rm *.orig
make config && make deinstall reinstall
service snort restart

ymmv.


--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
>*| *SECNAP Network Security Corporation

   * Best Mobile Solutions Product of 2011
   * Best Intrusion Prevention Product
   * Hot Company Finalist 2011
   * Best Email Security Product
   * Certified SNORT Integrator


______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.spammertrap.com/
______________________________________________________________________  
------------------------------------------------------------------------------
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!