snort-users May 2009 archive
Main Archive Page > Month Archives  > snort-users archives
snort-users: Re: [Snort-users] Snort rule download fails

Re: [Snort-users] Snort rule download fails

From: JJ Cummings <cummingsj_at_nospam>
Date: Fri May 15 2009 - 20:00:16 GMT
To: tech@jameson.co.uk


You could try Baconator (though if it's an issue of load on the snort.orgservers this will have no differing result).

Baconator is simply a rule management system that I came up with (still under development, hence no official tarball yet) to handle so_rules and address a few features that oinkmaster does not (i.e. it verifies the file hash, doesn't re-download the rules tarball if you already have the latest etc... and handles shared object rules).

Again, not that it's gonna solve your problem, but maybe it will help.

Get baconator here:
http://code.google.com/p/baconator/

Cheers,
JJC On Fri, May 15, 2009 at 1:27 PM, Brian Jameson <tech@jameson.co.uk> wrote:

> I am getting repeated failures when downloading the rules files from
> snort.org. This is happening with oinkmaster and wget. Well I suppose that
> is to be expected really as oinkmaster uses wget. Below is a sample of part
> of an 'oinkmaster' log. Does anyone know what I can do to solve this? This
> happens with 2.7 and 2.8.
>
> regards Brian
>
>
>
> 67300K .......... .......... .......... .......... .......... 73% 90.2K
> 6m51s
> 67350K .......... .......... .......... .......... .......... 73% 54.9K
> 6m50s
> 67400K .......... .......... .......... ... 73%
> 71.8K=19m7s
>
> 16:32:18 (58.8 KB/s) - Read error at byte 69052247/93673641 (Connection
> reset by
> peer). Retrying.
>
> --16:32:19-- (try: 2)
> http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode>
> /snortrules-snapshot-2.7.tar.gz
> Connecting to www.snort.org|68.177.102.20|:80... connected.
> HTTP request sent, awaiting response... 200 OK
> Length: 93673641 (89M) [application/octet-stream]
> Saving to: `/tmp/oinkmaster.2OWn4en19z/url.Mf1d5H6LuB/snortrules.tar.gz'
>
> 0K .......... .......... .......... .......... .......... 0% 28.0K
> 94m24s
> 50K .......... .......... .......... .......... .......... 0% 7.93K
> 3h34m
> 100K .......... .......... .......... .......... .......... 0% 430K
> 2h24m
> 150K .......... .......... .......... .......... .......... 0% 14.8K
> 2h33m
> 200K .......... .......... .......... .......... .......... 0% 74.1K
> 2h9m
> 250K ... 0% 44.8K=12s
>
> 16:32:34 (20.5 KB/s) - Read error at byte 69052247/93673641 (Connection
> reset by
> peer). Retrying.
>
> --16:32:36-- (try: 3)
> http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode>
> /snortrules-snapshot-2.7.tar.gz
> Connecting to www.snort.org|68.177.102.20|:80... connected.
> HTTP request sent, awaiting response... 403 Next download available at:
> 2009-05-
> 15 11:47:44 (Currently: 2009-05-15 11:33:02)
> 16:33:02 ERROR 403: Next download available at: 2009-05-15 11:47:44
> (Currently:
> 2009-05-15 11:33:02).
>
>
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables
> unlimited royalty-free distribution of the report engine
> for externally facing server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0ASnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>



Crystal Reports - New Free Runtime and 30 Day Trial Check out the new simplified licensing option that enables unlimited royalty-free distribution of the report engine for externally facing server and web deployment. http://p.sf.net/sfu/businessobjects



Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users