Re: Error 422 again

[Ian <snort_list () fishnet co uk>]

On 23/07/2014 04:13, Andre DiMino wrote:
> Hah, yes, I'd say I missed it.
> Thanks for the wake-up call guys ;-)

Hi,

I just got hit by this too.  I didn't realize that snort went EOL so
quickly!

Anyway...


Upgrading from RHEL6 snort version 2.9.4 I encountered a problem with
the version of the libdnet rpm required:

        libdnet.1()(64bit) is needed by snort-1:2.9.6.2-1.x86_64

The previous install had the EPEL repo version 1.12 (which worked) but I
had to force the install.

I have since discovered that the RPMFORGE version 1.11 works out of the
box and doesn't require the snort rpm to be force installed.


The steps involved were:

        Install RPMFORGE repo
        yum downgrade libdnet

        Edit the epel repo file and add the line:

        exclude=libdnet*


Regards

Ian
-- 



> On Tue, Jul 22, 2014 at 4:17 PM, waldo kitty <wkitty42 () windstream net>
> wrote:
>
> > On 7/21/2014 11:34 PM, Andre DiMino wrote:
> > > Tonight, trying to download the latest rules using pulledpork v0.7.0, I
> > get the
> > > following error:
> > >
> > > Checking latest MD5 for snortrules-snapshot-2941.tar.gz....
> > > Error 422 when fetching
> > > https://www.snort.org/reg-rules/snortrules-snapshot-2941.tar.gz.md5 at
> > > /xxxx/pulledpork-0.7.0/pulledpork.pl <http://pulledpork.pl> line 463.
> > > main::md5file('xxxx', 'snortrules-snapshot-2941.tar.gz', '/tmp/',
> > > 'https://www.snort.org/reg-rules/&apos;) called at
> > > /xxxx/pulledpork-0.7.0/pulledpork.pl <http://pulledpork.pl> line 1847
> > >
> > > It seems that there were issues earlier in the month, but were
> > addressed.  Did I
> > > miss a fix needed to be done on the client side?
> >
> > no, you didn't miss a fix... it appears that you missed an upgrade from
> > that old
> > EOL version of snort a year ago ;)
> >
> > https://www.snort.org/eol
> >
> > http://blog.snort.org/2013/07/snort-2941-is-now-eol-for-rule-support.html
> >
> > --
> >   NOTE: No off-list assistance is given without prior approval.
> >         Please *keep mailing list traffic on the list* unless
> >         private contact is specifically requested and granted.
> >
> >
> > ------------------------------------------------------------------------------


------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!