different error message, pulledpork.conf

[QutoSo]

Hi Forum Users,




my Problem is with Snort in the Version 2.9.7.0 and I this try to Install this with:

Setup Guide: „Snort 2.9.6.2 on Ubuntu 12 LTS and 14 LTS“

(from the Site: www.snort.org)

My System is a Ubuntu 14.04 Operating System.


I'm about the Chapter 11 with the headline „Rulesets and a Snort Code“.

After editing the „/etc/snort/pulledpork.conf“ like the guide,


I run following command:

sudo /usr/local/bin/pulledpork.pl -c /etc/snort/pulledpork.conf -l


Now I get the error message:

Checking latest MD5 for snortrules -2970.tar.gz.....

Error 422 when fetching https://www.snort.org/reg-rules/snortrules-snapshot-2970.tar.gz.md5 at /usr/local/bin/pulledpork.pl line 463

main::md5file('<XXX>', 'snortrules – snapshot-2970-tar.gz' ,' /tmp/' , 'https://www.snort.org/reg-rules/') called at /usr/local/bin/pulledpork.pl line 1847


Now I found following text more times:


„So,once it is working on the snort.org<http://snort.org/> website, the new rule_url line should be as you specified below, with no |, ignoring the rules specified?

“So I removed the Pipe- Symbols in the three lines with insert my <oinkcode>.
Then the upper errormessage disappeared but a new come in additon:

„You need to define an oinkcode, please review the rule_url section of the
pulledpork config file! “ at /usr/local/bin/pulledpork.pl line 1801.

If I try the configuration of the pulledpork.conf from this Website:https://code.google.com/p/pulledpork.../detail?id=157
I get the same error message which is there described.

What can I do now? My search days and hours are not sucessful.


Thanks to all,
QutoSo

[mike281]

Hey,

I'm curious, but did you try setting up pulledpork on an earlier version of Ubuntu? Like Ubuntu 12.10 ?

I'm having an issue myself using snort with base, and I'm going to try doing the setup again on Ubuntu 12.10 32bit, instead of Ubuntu 14.04 64bit . Since I can't find anything on the internet about the error I'm getting.

Good luck resolving your issue.

[frank96]

Was there a solution to this problem? I am having the exact same issue.

[hiepsykiemcun]

me, too ! HEPL ..HELP
Nobody know fix ???

[Bucky Ball]

Was there a solution to this problem? I am having the exact same issue.

me, too ! HEPL ..HELP
Nobody know fix ???

Obviously not as this thread has been dormant for nearly three months. Perhaps post a new one outlining your issues exactly and in the appropriate forum section (are you both using the server version?).

[hiepsykiemcun]

hi all !
You do not have to include the <> characters in the line.

[tancr3d]

hi all !
You do not have to include the <> characters in the line.

Hi Guys,

I had the same problem. I guess it comes from installing an older snort version and not the bleeding edge version from source.
For me helped changing the pulledpork.conf rule_url:

rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot-2975.tar.gz|<OINKCODE>

Because version 2970 did not exist.