How to decipher the Oinkcode for Snort's VRT rules

Sourcefire has changed the licensing and distribution of Snort rules, and created the VRT Certified rules, which are tested and certified by the Sourcefire Vulnerability Research Team.

As an end user, you can get these rules in one of three ways:

• Pay a subscription fee to Sourcefire and get the rules as soon as they are released
• Register for free and get the rules five days after they are released to paid subscribers
• Get whatever is current with each release of the Snort engine (in other words, no updates between engine updates, which is not recommended)

There are special considerations if you are a "Snort Integrator." In any case, you need to read the FAQ at Snort.org.

More Information Learn more about Sourcefire's changes Find out how you can get certified in Snort

If your organization is a Snort end user, you will almost certainly want to register for free and generate an Oinkcode, which will allow you to download the VRT rules. Once you have read and understood the FAQ, create an account at Snort.org and log in. At the bottom of the Account Settings page you will find a button to generate an Oinkcode, along with instructions for configuring your oinkmaster.conf, if you are using Oinkmaster. But even if you are not, the URL you construct (such as http://www.snort.org/pub-bin/oinkmaster.cgi/5a081649c06a277e1022e1284bdc8fabda70e2a4/snortrules-snapshot-2.3.tar.gz) may be bookmarked in a browser or used with wget or some other download tool to download the rules.

Your Oinkcode for VRT Certified rules will look like this:
http://www.snort.org/pub-bin/oinkmaster.cgi//

Example for snort 2.3:
http://www.snort.org/pub-bin/oinkmaster.cgi/5a081649c06a277e1022e1284bdc8fabda70e2a4/snortrules-snapshot-2.3.tar.gz

You can also get GPL community rules (free, no registration or Oinkcode required, very limited) from Snort.org

SNORT INTRUSION DETECTION AND PREVENTION GUIDE

  Introduction
  Why Snort makes IDS worth the time and effort
  How to identify and monitor network ports after intrusion detection
  How to handle network design with switches and segments
  Where to place IDS network sensors
  Finding an OS for Snort IDS sensors
  How to determine network interface cards for IDS sensors
  Modifying and writing custom Snort IDS rules
  How to configure Snort variables
  Where to find Snort IDS rules
  How to automatically update Snort rules
  How to decipher the Oinkcode for Snort's VRT rules
  Using IDS rules to test Snort

ABOUT THE AUTHOR:

JP Vossen, CISSP, is a Senior Security Engineer for Counterpane Internet Security. He is involved with various open source projects including Snort, and has previously worked as an information security consultant and systems engineer.

Rate this Tip To rate tips, you must be a member of SearchSecurity.com. Register now to start rating these tips. Log in if you are already a member. Digg This!     StumbleUpon     Del.icio.us    RELATED CONTENT Network Security Tactics Screencast: Catching network traffic with Wireshark Enterprise role management: Trends and best practices Using Nessus Attack Scripting Language (NASL) to find application vulnerabilities Screencast: Recovering lost data with WinHex How to build security into a virtualized server environment How to install and configure Nessus How to run a Nessus system scan Nessus: Vulnerability scanning in the enterprise Screencast: An introduction to the Open Source Security Testing Methodology Manual (OSSTMM) Understanding multifactor authentication features in IAM suites Network Intrusion Detection (IDS) What are best practices for creating an IDS and maintaining a signature database? Network intrusion prevention systems: Should enterprises deploy now? RSA 2008: Sourcefire founder Roesch previews Snort 3 What is the best possible IDS deployment for an Enterprise Resource Planning (ERP) system? Screencast: Opening up the Network Security Toolkit Can a firewall alone effectively block port-scanning activity? Should an intrusion detection system (IDS) be written using Java? What security risks do enterprise honeypots pose? What are the benefits of 'in-the-cloud' network security services? Screencast: Snort -- Tactics for basic network analysis Network Intrusion Detection (IDS) Research RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary computer forensics  (SearchSecurity.com) Diffie-Hellman key exchange  (SearchSecurity.com) Einstein  (SearchSecurity.com) HIDS/NIDS  (SearchSecurity.com) intrusion detection  (SearchSecurity.com) network behavior analysis  (SearchSecurity.com) ultrasound  (SearchSecurity.com) RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.