Snort mailing list archives
Re: sid-msg.map and the new .rules files
From: JJC <cummingsj () gmail com>
Date: Wed, 31 Oct 2012 10:33:58 -0600
sid-msg.map or gen-msg.map? the subject indicates one, while the body indicates the other.. that said sid-msg.map seems to make the most sense. Joel, correct me if I'm wrong but I believe that the expectation is that users generate their own sid-msg.map going forward, this guarantees that local.rules etc.. are included in said sid-msg.map. PulledPork natively does this, and Oinkmaster includes a contrib script that does this. JJC On Wed, Oct 31, 2012 at 10:23 AM, Kungu Panda <kungupanda () gmail com> wrote:
VRT folks, can you confirm that some of the new .rules files are not making it into the gen-msg.map ? For example, sid 17645 which is included in the new browser-ie.rules and sid 16008 which is in the new os-windows.rules file? I am looking at a current VRT signature tarball for snort v2931. It appears, perhaps, that the scripts used to create the gen-msg.map do not include some of the new .rules files.. Thanks, KunguPanda ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- sid-msg.map and the new .rules files Kungu Panda (Oct 31)
- Re: sid-msg.map and the new .rules files JJC (Oct 31)
- Re: sid-msg.map and the new .rules files Joel Esler (Oct 31)
- Re: sid-msg.map and the new .rules files Kungu Panda (Nov 01)
- Re: sid-msg.map and the new .rules files Pratik Narang (Nov 01)
- Re: sid-msg.map and the new .rules files JJ Cummings (Nov 01)
- Re: sid-msg.map and the new .rules files waldo kitty (Nov 01)
- Re: sid-msg.map and the new .rules files Joel Esler (Oct 31)
- Re: sid-msg.map and the new .rules files JJC (Oct 31)