Re: Snort rule download fails

[JJ Cummings <cummingsj () gmail com>]

You could try Baconator (though if it's an issue of load on the
snort.orgservers this will have no differing result).

Baconator is simply a rule management system that I came up with (still
under development, hence no official tarball yet) to handle so_rules and
address a few features that oinkmaster does not (i.e. it verifies the file
hash, doesn't re-download the rules tarball if you already have the latest
etc... and handles shared object rules).

Again, not that it's gonna solve your problem, but maybe it will help.

Get baconator here:
http://code.google.com/p/baconator/

Cheers,
JJC

On Fri, May 15, 2009 at 1:27 PM, Brian Jameson <tech () jameson co uk> wrote:

> I am getting repeated failures when downloading the rules files from
> snort.org. This is happening with oinkmaster and wget. Well I suppose that
> is to be expected really as oinkmaster uses wget. Below is a sample of part
> of an 'oinkmaster' log. Does anyone know what I can do to solve this? This
> happens with 2.7 and 2.8.
>
> regards Brian
>
>
>
> 67300K .......... .......... .......... .......... .......... 73% 90.2K
> 6m51s
>  67350K .......... .......... .......... .......... .......... 73% 54.9K
> 6m50s
>  67400K .......... .......... .......... ...                   73%
> 71.8K=19m7s
>
> 16:32:18 (58.8 KB/s) - Read error at byte 69052247/93673641 (Connection
> reset by
>  peer). Retrying.
>
> --16:32:19--  (try: 2)
> http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode>
> /snortrules-snapshot-2.7.tar.gz
> Connecting to www.snort.org|68.177.102.20|:80... connected.
> HTTP request sent, awaiting response... 200 OK
> Length: 93673641 (89M) [application/octet-stream]
> Saving to: `/tmp/oinkmaster.2OWn4en19z/url.Mf1d5H6LuB/snortrules.tar.gz'
>
>     0K .......... .......... .......... .......... ..........  0% 28.0K
> 94m24s
>    50K .......... .......... .......... .......... ..........  0% 7.93K
> 3h34m
>   100K .......... .......... .......... .......... ..........  0%  430K
> 2h24m
>   150K .......... .......... .......... .......... ..........  0% 14.8K
> 2h33m
>   200K .......... .......... .......... .......... ..........  0% 74.1K
> 2h9m
>   250K ...                                                     0% 44.8K=12s
>
> 16:32:34 (20.5 KB/s) - Read error at byte 69052247/93673641 (Connection
> reset by
>  peer). Retrying.
>
> --16:32:36--  (try: 3)
> http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode>
> /snortrules-snapshot-2.7.tar.gz
> Connecting to www.snort.org|68.177.102.20|:80... connected.
> HTTP request sent, awaiting response... 403 Next download available at:
> 2009-05-
> 15 11:47:44 (Currently: 2009-05-15 11:33:02)
> 16:33:02 ERROR 403: Next download available at: 2009-05-15 11:47:44
> (Currently:
> 2009-05-15 11:33:02).
>
>
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables
> unlimited royalty-free distribution of the report engine
> for externally facing server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0ASnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables 
unlimited royalty-free distribution of the report engine 
for externally facing server and web deployment. 
http://p.sf.net/sfu/businessobjects

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users