Order of Rules Based upon Action

122 Chapter 3 • Working with Snort Rules

3.9.2 The Sophisticated and Complex Method

This section provides information about the use of Oinkmaster found at http: www.algonet.se~nitzeroinkmaster. Oinkmaster is a tool to update Snort rule files. It is written in Perl, so you must have Perl installed on your Snort machine to make this tool work. It can be configured to download new rule files from the Internet, find out what rules need to be updated and then updates them. If you have modified some standard rules according to your own requirements, you can configure Oinkmaster not to update these customized rules. At the time of writing this book, version 0.6 of this tool is avail- able. By now updated versions may be available. Oinkmaster is a Perl script and uses a configuration file to update the rules. It is recommended that you use a temporary directory the first time you use this Perl script. I have used tmprules directory. When you use the following command, it will download all rules, untar them and save all files in tmprules directory. [rrconformix] .oinkmaster.pl -o tmprules Downloading rules archive from http:www.snort.orgdlsignatures snortrules.tar.gz... 12:27:09 URL:http:www.snort.orgdlsignaturessnortrules.tar.gz [7948779487] - tmpoinkmaster.9875snortrules.tar.gz [1] Archive successfully downloaded, unpacking... tar: rulesattack-responses.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesclassification.config: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulessid-msg.map: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesx11.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesweb-misc.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesweb-iis.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesweb-frontpage.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesweb-coldfusion.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesweb-cgi.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesweb-attacks.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesvirus.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulestftp.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulestelnet.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulessql.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulessmtp.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesshellcode.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future tar: rulesscan.rules: time stamp 2002-07-14 13:10:24 is 348194 s in the future Automatically Updating Snort Rules 123