Re: Compiling snort for CheckPoint Firewall-1 support

[Nigel Houghton <nigel () sourcefire com>]

On  0, carlopmart <carlopmart () gmail com> wrote:
> Hi Frank,
>
>  Yes, correct but I need to modify snort rules by hand if i would to 
> block some connections with snortsam (and if I launch process to update 
> snort rules, they are overwritted and I lose my changes). I need to 
> block connections immediately using snort rules and custom rules.

Oinkmaster can be configured to not only preserve your rule changes when
updating, but also make some changes for you automatically. That way
you can change something in a rule and have oinkmaster make the same
change for you when you get an updated version of the rule.

Take a look somewhere around line 229 in the oinkmaster.conf it is well
documented on how to achieve this. Somewhere near line 370 you should
find information on how to skip some rules from being updated.

+--------------------------------------------------------------------+
     Nigel Houghton      Research Engineer       Sourcefire Inc.
                   Vulnerability Research Team

         There is no theory of evolution, just a list
            of creatures Vin Diesel allows to live.


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users