Re: [Snort-devel] i have only 600 rules in my snort3

are those rules commented out in your pulledpork.lua? are you sure you're
loading the correct rules file in your snort.lua?
can you include your snort.lua as a reply.

On Wed, Mar 2, 2022 at 9:44 AM Dorian ROSSE <[email protected]> wrote:

> I am saying with your downloading of rules to pulled pork I have around
> 15000 rules but snort3 use by the begun 600 rules without use pulled pork,
>
> Thanks you in advance for help myself use all the rules,
>
> Regards.
>
>
> Dorian Rosse.
> ------------------------------
> *From:* Noah Dietrich <[email protected]>
> *Sent:* Wednesday, March 2, 2022 8:19:48 PM
> *To:* Dorian ROSSE <[email protected]>
> *Cc:* Maya Dagon (mdagon) <[email protected]>; [email protected]
> <[email protected]>; [email protected] <
> [email protected]>; [email protected] <
> [email protected]>
> *Subject:* Re: [Snort-users] [Snort-devel] i have only 600 rules in my
> snort3
>
> Hello,
> From my earlier email, this is probably related to the ips_policy in your
> pulledpork.conf file.
> are you saying that your pulledpork.rules file has 15000 rules, but snort
> only shows 600 rules when loading?
>
> On Wed, Mar 2, 2022 at 9:10 AM Dorian ROSSE <[email protected]>
> wrote:
>
> Pulled pork has downloaded around 15000 rules but snort3 use 600 rules,
>
> Thanks you in advance to explain to myself how to use all the rules,
>
> Regards.
>
>
> Dorian Rosse.
> ------------------------------
> *From:* Noah Dietrich <[email protected]>
> *Sent:* Wednesday, March 2, 2022 8:05:21 PM
> *To:* Dorian ROSSE <[email protected]>
> *Cc:* Maya Dagon (mdagon) <[email protected]>; [email protected]
> <[email protected]>; [email protected] <
> [email protected]>; [email protected] <
> [email protected]>
> *Subject:* Re: [Snort-users] [Snort-devel] i have only 600 rules in my
> snort3
>
> Hello.
> I do not understand your question. can you please clarify the issue you
> are having?
>
> On Wed, Mar 2, 2022 at 9:03 AM Dorian ROSSE <[email protected]>
> wrote:
>
> I have the truth,
>
> Pulled pork download more rules than snort3 use,
>
> Thanks you in advance to help myself use all the rules,
>
> Regards.
>
>
> Dorian Rosse.
> ------------------------------
> *From:* Noah Dietrich <[email protected]>
> *Sent:* Wednesday, March 2, 2022 8:01:55 PM
> *To:* Dorian ROSSE <[email protected]>
> *Cc:* Maya Dagon (mdagon) <[email protected]>; [email protected]
> <[email protected]>; [email protected] <
> [email protected]>; [email protected] <
> [email protected]>
> *Subject:* Re: [Snort-users] [Snort-devel] i have only 600 rules in my
> snort3
>
> Hello,
>
> I do not think that is the issue here. If you have 600 rules in your rules
> file, then those rules are being downloaded (the local.rules only has two
> rules).
> Please see my previous email regarding modifying your pulledpork.conf file
> if you want to enable more rules.
>
> Noah
>
> On Mon, Feb 28, 2022 at 11:33 PM Dorian ROSSE <[email protected]>
> wrote:
>
> Dear Noah,
>
>
> The error is too here :
>
> In your configuration of the snort configuration you do read only the
> rules local,
>
> Thanks you in advance to explain how to read all the folders of rules,
>
> Regards.
>
>
> Dorian Rosse.
> ------------------------------
> *From:* Noah Dietrich <[email protected]>
> *Sent:* Monday, February 28, 2022 10:18:01 PM
> *To:* Dorian ROSSE <[email protected]>
> *Cc:* Maya Dagon (mdagon) <[email protected]>; [email protected]
> <[email protected]>; [email protected] <
> [email protected]>; [email protected] <
> [email protected]>
> *Subject:* Re: [Snort-users] [Snort-devel] i have only 600 rules in my
> snort3
>
> Hello,
>
> I think the reason you only have 600 rules is because of the "ips_policy"
> setting in your pulledpork.conf file (I assume you're using PulledPork3,
> but it's similar for PP2).
> This setting determines how many rules from the downloaded ruleset are
> enabled, based on your appetite for risk.  From the pulledpork.conf file:
>
> # Enable / Disable rules based on the level of functionality/security you
> want.
> # must be one of: *connectivity, balanced, security, max-detect, none*
> # default is connectivity. Will not work with community ruleset.
> # https://www.snort.org/faq/why-are-rules-commented-out-by-default
> *ips_policy = balanced*
>
> If you want more rules enabled from the ruleset, choose *security *or *
> max-detect* for this setting and re-run pulledpork.
>
> Noah
>
>
>
>
>
> On Mon, Feb 28, 2022 at 8:35 AM Dorian ROSSE via Snort-users <
> [email protected]> wrote:
>
> I use the configuration edited from the pdf created by Noah Dietrich for
> snort3 on Ubuntu 18 & 20,
>
> By the begun I have 600 rules like the system doesn't read rules before I
> downloaded the rules I have ever 600 rules,
>
> Have you a repairing ?
>
> Thanks you in advance for your help,
>
> Regards.
>
>
> Dorian Rosse.
> ------------------------------
> *From:* Maya Dagon (mdagon) <[email protected]>
> *Sent:* Monday, February 28, 2022 4:34:28 PM
> *To:* Dorian ROSSE <[email protected]>; [email protected] <
> [email protected]>; [email protected] <
> [email protected]>; [email protected] <
> [email protected]>
> *Subject:* Re: [Snort-devel] i have only 600 rules in my snort3
>
>
> Hi Dorian,
>
>
>
> The path depends on your configuration. Are you including the rules from
> another file? Is it using relative path?
>
>
>
> Thanks,
>
> Maya
>
>
>
> *From: *Snort-devel <[email protected]> on behalf of
> Dorian ROSSE via Snort-devel <[email protected]>
> *Reply-To: *Dorian ROSSE <[email protected]>
> *Date: *Saturday, February 26, 2022 at 6:46 AM
> *To: *"[email protected]" <[email protected]>, "
> [email protected]" <[email protected]>, "
> [email protected]" <[email protected]>
> *Subject: *Re: [Snort-devel] i have only 600 rules in my snort3
>
>
>
> my rules are located under :* '''/usr/local/etc/rules/rules$''' *and*
> '''/usr/local/etc/rules/so_rules$'''*,
>
>
>
> should i down up in the root etc like thoses :
> *'''/usr/local/etc/rules'''* and *'''/usr/local/etc/so_rules''' *?
>
>
>
> thank you in advance for your answer lighted,
>
>
>
> Regards.
>
>
>
>
>
> Dorian ROSSE.
> ------------------------------
>
> *De :* Dorian ROSSE
> *Envoyé :* vendredi 25 février 2022 16:43
> *À :* [email protected] <[email protected]>;
> [email protected] <[email protected]>;
> [email protected] <[email protected]>
> *Objet :* i have only 600 rules in my snort3
>
>
>
> Hello,
>
>
>
>
>
> i have this problem :
>
>
>
> '''rule counts
>
>        total rules loaded: 600
>
>             builtin rules: 600
>
>             option chains: 600
>
>             chain headers: 1'''
>
>
>
> ethtool is again broken then i have go more far,
>
>
>
> why i have only 600 rules ?
>
>
>
> i have succesfully installed pulledpork and downloaded the rules,
>
>
>
> thank you in advance to help myself fully configured snort3,
>
>
>
> Regards.
>
>
>
>
>
> Dorian ROSSE.
> _______________________________________________
> Snort-users mailing list
> [email protected]
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
>         To unsubscribe, send an email to:
>         [email protected]
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
> Please follow these rules:
> https://snort.org/faq/what-is-the-mailing-list-etiquette
>
>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette