Re: pulledpork rules update error 422

["Joel Esler (jesler)" <jesler () cisco com>]

2.9.6.2 is over two years old.  It hit the EOL last week.


--
Joel Esler
Manager, Talos Group




On Mar 9, 2016, at 8:01 PM, Mathias Conde <conma293 () gmail com<mailto:conma293 () gmail com>> wrote:

ah man, but the current version is 2.9.8.0 ??

thought they would stay live till 3.0!! that sucks big time.

any quick way to update snort trick that anyone knows apt-get update snort? haha

im running 2962 on FC19 (also EOL??? man)



On Thu, Mar 10, 2016 at 1:58 PM, Shirkdog <shirkdog () gmail com<mailto:shirkdog () gmail com>> wrote:

2.9.6.2 is so End of Life it has almost reincarnated as 3.0.6.2.

Yeah 422 with pulled pork always (99% of the time) points to your Snort version being EoL.

On Mar 9, 2016 7:53 PM, "Mathias Conde" <conma293 () gmail com<mailto:conma293 () gmail com>> wrote:
erroring out on attempted snort rule updates via pulledpork, its been a while between updates...
double checked the URL's everything seems in order?
Am I missing something? running snort 2.9.6.2 ... surely thats not too old??

Base URL is: 
https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|e51f5319d3ff9bc759a8689cb7f361a2a530e70f<https://www.snort.org/reg-rules/%7csnortrules-snapshot.tar.gz%7ce51f5319d3ff9bc759a8689cb7f361a2a530e70f>
 
http://labs.snort.org/feeds/ip-filter.blf|IPBLACKLIST|open<http://labs.snort.org/feeds/ip-filter.blf%7cIPBLACKLIST%7copen>
 
https://www.snort.org/reg-rules/|opensource.gz|e51f5319d3ff9bc759a8689cb7f361a2a530e70f<https://www.snort.org/reg-rules/%7copensource.gz%7ce51f5319d3ff9bc759a8689cb7f361a2a530e70f>
Checking latest MD5 for snortrules-snapshot-2962.tar.gz....
Fetching md5sum for: snortrules-snapshot-2962.tar.gz.md5
** GET https://www.snort.org/reg-rules/snortrules-snapshot-2962.tar.gz.md5/e51f5319d3ff9bc759a8689cb7f361a2a530e70f ==> 
422 Unprocessable Entity (17s)
Error 422 when fetching https://www.snort.org/reg-rules/snortrules-snapshot-2962.tar.gz.md5 at 
/usr/local/snort/pulledpork/pulledpork.pl<http://pulledpork.pl/> line 463.
main::md5file('e51f5319d3ff9bc759a8689cb7f361a2a530e70f', 'snortrules-snapshot-2962.tar.gz', '/tmp/', 
'https://www.snort.org/reg-rules/&apos;) called at /usr/local/snort/pulledpork/pulledpork.pl<http://pulledpork.pl/> line 1847

------------------------------------------------------------------------------
Transform Data into Opportunity.
Accelerate data analysis in your applications with
Intel Data Analytics Acceleration Library.
Click to learn more.
http://pubads.g.doubleclick.net/gampad/clk?id=278785111&iu=/4140
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net<mailto:Snort-users () lists sourceforge net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org<http://blog.snort.org/> to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Transform Data into Opportunity.
Accelerate data analysis in your applications with
Intel Data Analytics Acceleration Library.
Click to learn more.
http://pubads.g.doubleclick.net/gampad/clk?id=278785111&iu=/4140_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Transform Data into Opportunity.
Accelerate data analysis in your applications with
Intel Data Analytics Acceleration Library.
Click to learn more.
http://pubads.g.doubleclick.net/gampad/clk?id=278785111&iu=/4140

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!