<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=unicode" /> <meta http-equiv="Content-Language" content="en-us" /> <title>Install, configure and run Oinkmaster - Snort rules update tools using Oinkmaster GUI</title> <style> <!-- p.MsoNormal {margin-top:0mm; margin-right:0mm; margin-bottom:10.0pt; margin-left:0mm; line-height:115%; font-size:12.0pt; font-family:"Times New Roman","serif";} a:link {color:blue; text-decoration:underline;} a:visited {color:purple; text-decoration:underline;} p {margin-right:0mm; margin-left:0mm; font-size:12.0pt; font-family:"Times New Roman","serif";} ol {margin-bottom:0mm;} h1 {margin-top:12.0pt; margin-right:0mm; margin-bottom:3.0pt; margin-left:0mm; page-break-after:avoid; font-size:16.0pt; font-family:Arial;} --> </style> <meta name="keywords" content="intrusion detection, opensource, data, update tools, services, technology, applications, packages, examples, samples, hardware, protection, prevention" /> <meta name="description" content="This is a complete tutorial on how to setup and configure Oinkmaster, Snort IDS rules update on Windows system" /> </head> <body lang="EN-US" link="#0000FF" vlink="#800080" topmargin="20" leftmargin="20" rightmargin="20" bottommargin="20"> <div class="WordSection1"> <h1 align="center" style="margin-top: 0; margin-bottom: 0"> <span style="font-weight: 400"><font size="4">&lt; <span style="text-decoration: none"><font color="#000000"> <a title="Perl and Windows Script Host (WSH)" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb15.html"> Perl and Windows Script Host (WSH)</a></font></span> | <a title="Java and open source - information, tutorials, install, setup, configure" target="_top" href="http://www.javaguicodexample.com/"> Java &amp; Friends</a> | <span style="text-decoration: none"> <font color="#000000"> <a title="Windows XP Pro SP2, Snort 2.8.6, MySQL and BASE" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpmysqlbaseperladodbwinxp.pdf"> This tutorial in single pdf file (~12MB)</a></font></span>&gt;</font></span></h1> <hr noshade color="#FF3300" /> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <h1 align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><span style="font-weight: 400"><font face="Arial" size="6">Install, Configure and Running Oinkmaster</font></span></h1> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font face="Arial">What do we have in this session?</font></b></p> <ol> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Installing and Configuring Oinkmaster</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Running the Oinkmaster GUI</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Updating Tk Package</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Configuring Oinkmaster from Oinkmaster GUI</font></span></h1> </li> <li> <h1 style="margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Getting the Oinkmaster Code</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0;line-height: normal; margin-top:0"><span style="font-weight: 400"> <font size="3" face="Arial">Example for snort 2.8.6.0:</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0;line-height: normal; margin-top:0"><span style="font-weight: 400"> <font size="3" face="Arial">Example for Snort 2.8.5.3:</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0;line-height: normal; margin-top:0"><span style="font-weight: 400"> <font size="3" face="Arial">Example for Snort 2.8 (This will be deprecated on June 2010):</font></span></h1> </li> <li> <h1 style="margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Continue on Configuring Oinkmaster</font></span></h1> </li> <li> <h1 style="margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Updating Snort Rules using Oinkmaster</font></span></h1> </li> <li> <h1 style="margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Further Reading and Fun Activities</font></span></h1> </li> </ol> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; /* 728x90, created 5/16/08 javaos */ google_ad_slot = "1917524460"; google_ad_width = 728; google_ad_height = 90; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Installing and Configuring Oinkmaster</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Now, we are ready to install and configure Oinkmaster. Firstly download the latest version at <a href="http://oinkmaster.sourceforge.net/download.shtml" target="_blank" title="Oinkmaster - the Snort rules update tool"> Oinkmaster</a>.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="539" height="363" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp226.png" alt="Downloading Oinkmaster file" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Extract the compressed file. In this case we downloaded and uncompress the file in Snort root folder.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="572" height="125" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp227.png" alt="Extracting the Oinkmaster gz file" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="518" height="116" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp228.png" alt="Extracting the Oinkmaster tar file" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Running the Oinkmaster GUI</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Next, run the Oinkmaster GUI program (<b>oinkgui.pl</b>) from Windows command prompt or double click the file from Windows Explorer. The file should be under <b><span style="font-weight:bold">contrib</span></b> sub folder.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;Snort\oinkmaster-2.0\contrib&gt;oinkgui.pl</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Can&#39;t locate Tk.pm in @INC (@INC contains: C:/Perl/site/lib C:/Perl/lib .) at C:\Snort\oinkmaster-2.0\contrib\oinkgui.pl line 45.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> BEGIN failed--compilation aborted at C:\Snort\oinkmaster-2.0\contrib\oinkgui.pl line 45.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Updating Tk Package</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> We got some error here. Let update Tk package by issuing the following command at Windows command prompt (also can be done using PPM GUI).</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;Perl&gt;ppm install Tk</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="557" height="217" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp229.png" alt="Installing Perl Tk component from command line" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="477" height="331" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp230.png" alt="The Oinkmaster GUI file" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Configuring Oinkmaster from Oinkmaster GUI</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Next, re-run the oinkgui.pl from Windows command prompt or double click the file from Windows Explorer.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;Snort\oinkmaster-2.0\contrib&gt;oinkgui.pl</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The following screenshot shows Oinkmaster GUI. Now we are ready to do basic configuration.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="672" height="468" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp231.png" alt="The Oinkmaster GUI in action" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Left-click the &#39;Required files and directories&#39; tab. There are three dialog boxes that must be configured.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">In the &#39;oinkmaster.pl&#39; dialog box type &#39;C:/Snort/oinkmaster/oinkmaster.pl&#39; (less the quotes), and the button should turn from &#39;Red&#39; to &#39;Green&#39;, indicating the path has been set correctly.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">In the &#39;oinkmaster.conf&#39; dialog box type &#39;C:/Snort/oinkmaster/oinkmaster.conf&#39; (less the quotes), and the button should turn from &#39;Red&#39; to &#39;Green&#39;, indicating the path has been set correctly.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">In the &#39;output directory&#39; dialog box type &#39;C:/Snort/rules/&#39; (less the quotes), and the button should turn from &#39;Red&#39; to &#39;Green&#39;, indicating the path has been set correctly.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> You can use the Browse button to browse and select those files.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="672" height="468" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp232.png" alt="Configuring Oinkmaster required files and directories" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">Next, left-click on the &#39;Optional files and directories&#39; tab. There are four dialog boxes that should be configured. To the right in the &#39;Alternate URL&#39; dialog box left-click the down radio button, select the &#39;http://www.snort.org/pub-bin/oinkmaster.cgi/&lt;OINK_CODE&gt;/ snortrules-snapshot-2860.tar.gz</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;&#39; (less the quotes), and the button should turn from &#39;Red&#39; to &#39;Green&#39;, indicating the path has been set correctly.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">You must insert your specific generated &#39;OINK_CODE&#39; in the above configuration that was generated from the Snort.org site, and is located at the bottom of your &#39;Account Settings&#39; page.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><b><font size="3" face="Arial"> <span style="font-size:12.0pt;font-weight:bold">Getting the Oinkmaster Code</span></font></b></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">Register at Snort.org (if you are not registered user yet) and login. Click the <b>Subscriptions and Oinkcodes</b> tab. Click <b>Oinkcodes</b> link, generate and get the code. The following screenshot demonstrates the page on how to get the Oinkmaster code.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p align="center" style="margin:0mm;margin-bottom:.0001pt;text-align:center"> <font size="3" face="Arial"><span style="font-size:12.0pt"> <img border="0" width="630" height="222" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp233.png" alt="Getting Oinkmaster code from Snort.org" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Arial"><span style="font-size:12.0pt">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Arial"><span style="font-size:12.0pt">Take note that, the CURRENT and 2.8 naming conventions will be deprecated on June 2010 for oinkmaster downloads. So, you will be responsible for updating your oinkmaster.conf file (done through oinkmaster GUI) to reflect your installed version of Snort.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Arial"><span style="font-size:12.0pt">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Arial"> <span style="font-size:12.0pt; font-weight:bold">Example for Snort 2.8.6.0:</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Arial"><span style="font-size:12.0pt">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Courier New">url = http://www.snort.org/pub-bin/oinkmaster.cgi/&lt;oinkmaster_code_here&gt;/snortrules-snapshot-2860.tar.gz</font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Arial"><span style="font-size:12.0pt">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Arial"> <span style="font-size:12.0pt; font-weight:bold">Example for Snort 2.8.5.3:</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Arial"><span style="font-size:12.0pt">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Courier New">url = http://www.snort.org/pub-bin/oinkmaster.cgi/&lt;oinkmaster_code_here&gt;/snortrules-snapshot-2853.tar.gz</font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Arial"><span style="font-size:12.0pt">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><b><font size="3" face="Arial"> <span style="font-size:12.0pt; font-weight:bold">Example for Snort 2.8 (This will be deprecated on June 2010):</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Arial"><span style="font-size:12.0pt">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Courier New">url = http://www.snort.org/pub-bin/oinkmaster.cgi/&lt;oinkmaster_code_here&gt;/snortrules-snapshot-2.8.tar.gz</font></p> </blockquote> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><b><font size="3" face="Arial"> <span style="font-size:12.0pt;font-weight:bold">Continue on Configuring Oinkmaster</span></font></b></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">Next, let continue configuring Oinkmaster. In the &#39;Alternate URL&#39; dialog box scroll to the right and replace the &#39;OINK_CODE&#39; (less the quotes) with your unique generated oinkcode.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">In the &#39;Variable File&#39; dialog box type &#39;C:/Snort/etc/snort.conf&#39; (less the quotes), and the button should turn from &#39;Red&#39; to &#39;Green&#39;, indicating the path has been set correctly.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">To the left of the &#39;Browse&#39; button there is a &#39;Edit&#39; button that will allow the &#39;snort.conf&#39; file to be loaded and edited by clicking on the &#39;Edit&#39; button.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">Open a command window, at the command prompt type &#39;<b>mkdir C:\Snort\temp\</b>&#39; (less the quotes), and tap the &#39;Enter&#39; key.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">At the command prompt type &#39;exit&#39; (less the quotes), and tap the &#39;Enter&#39; key to exit the command window.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"> <!-- google_ad_client = "pub-8089415323104206"; /* 300x250, created 5/16/08javaos */ google_ad_slot = "8146009330"; google_ad_width = 300; google_ad_height = 250; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt" align="center"> <font face="Arial">--------------------------------------------------------</font></p> <p align="center" style="margin:0mm;margin-bottom:.0001pt;text-align:center"> <font size="3" face="Arial"><span style="font-size:12.0pt"> <img border="0" width="542" height="391" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp234.png" alt="Oinkmaster - creating temp folder for configuring Oinkmaster" /></span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">In the &#39;Backup directory&#39; dialog box type &#39;C:/Snort/temp/&#39; (less the quotes), and the button should turn from &#39;Red&#39; to &#39;Green&#39;, indicating the path has been set correctly.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">In the &#39;Editor&#39; dialog box type &#39;C:\Program Files\Windows NT\Accessories\wordpad.exe&#39; (less the quotes), and the button should turn from &#39;Red&#39; to &#39;Green&#39;, indicating the path has been set correctly. The path to WordPad may be different, so make SURE to include the correct path. Left-click the &#39;Save current settings&#39; button, and there should be a &#39;Successfully saved...&#39; message in the &#39;Output messages:&#39; screen.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p align="center" style="margin:0mm;margin-bottom:.0001pt;text-align:center"> <font size="3" face="Arial"><span style="font-size:12.0pt"> <img border="0" width="672" height="468" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp235.png" alt="Oinkmaster - configuring the optional files and directories" /></span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p align="center" style="margin:0mm;margin-bottom:.0001pt;text-align:center"> <font size="3" face="Arial"><span style="font-size:12.0pt"> <img border="0" width="672" height="468" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp236.png" alt="Oinkmaster - saving new configuration" /></span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><b><font size="3" face="Arial"> <span style="font-size:12.0pt;font-weight:bold">Updating Snort Rules using Oinkmaster</span></font></b></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">Depending on your installation paths for Snort and Oinkmaster, you should change those paths accordingly. Now it&#39;s time to update the Snort rules. Close Oinkmaster GUI and re-open it. Click Update rules! button on the left. Notice the messages on the right pane.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p align="center" style="margin:0mm;margin-bottom:.0001pt;text-align:center"> <font size="3" face="Arial"><span style="font-size:12.0pt"> <img border="0" width="608" height="670" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp237.png" alt="Updating Snort Rules using Oinkmaster in action" /></span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p align="center" style="margin:0mm;margin-bottom:.0001pt;text-align:center"> <font size="3" face="Arial"><span style="font-size:12.0pt"> <img border="0" width="620" height="522" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp238.png" alt="Updating Snort Rules using Oinkmaster - update was completed with error because there is no new update actually" /></span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">The first time Oinkmaster updates the rules there will be a lot of text displayed to the screen as it&#39;s collecting all the data for the next update. If the Snort is running, you may want to stop it and re-run again. If there was a problem with one or more rules Snort will refuse to start. Check the Windows &#39;Event Viewer&#39; and select &#39;Application&#39; to see any error that Snort generated on startup. All errors must be resolved in order for Snort to run. After each rule update Snort must be restarted in order for the new rule changes to be in effect.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><b><font size="3" face="Arial"> <span style="font-size:12.0pt;font-weight:bold">Further Reading and Fun Activities</span></font></b></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">Well, to further your investigation and fun, you may want to simulate attacks, viewing and recognizing the patterns and many more fun and funny things, you should try <a href="http://www.itoc.usma.edu/research/dataset/index.html" target="_blank" title="The Data Capture from National Security Agency (NSA) download page"> Data Capture from National Security Agency (NSA)</a> to simulate the real attacks and Snort can be used to explore and study many things regarding the network security up to the packet level.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p align="center" style="margin:0mm;margin-bottom:.0001pt;text-align:center"> <font size="3" face="Arial"><span style="font-size:12.0pt">------------------ End --------------------</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;<div align="center"><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=527221&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=85439"></script></div> </p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <hr noshade color="#FF3300" /> <p class="MsoNormal" style="margin-top: 0; margin-bottom: 0" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "3545464564"; google_ad_width = 728; google_ad_height = 15; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <h1 align="center" style="margin-top: 0; margin-bottom: 0"> <span style="font-weight: 400"><font size="4">&lt; <span style="text-decoration: none"><font color="#000000"> <a title="Perl and Windows Script Host (WSH)" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb15.html"> Perl and Windows Script Host (WSH)</a></font></span> | <a title="Java and open source - information, tutorials, install, setup, configure" target="_top" href="http://www.javaguicodexample.com/"> Java &amp; Friends</a> | <span style="text-decoration: none"> <font color="#000000"> <a title="Windows XP Pro SP2, Snort 2.8.6, MySQL and BASE" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpmysqlbaseperladodbwinxp.pdf"> This tutorial in single pdf file (~12MB)</a></font></span>&gt;</font></span></h1> </div> </body> </html>