On 2012-10-04 at 11:02:46 -0400, Lawrence Teo wrote: > On Thu, Oct 04, 2012 at 08:52:36AM -0400, Adam Jeanguenat wrote: > > In the snort.org URLs above, I would recommend replacing 'sub-rules' > > with 'reg-rules'. The 'sub-rules' URLs are for the paid subscription > > rules and I believe will fail if your oink code is associated with a > > non-paid account. > > Adam, thank you for the comment. 'sub-rules' will still work for a > non-paid account; it will just fallback to giving you the non-paid rules > tarball. For example I don't have a paid subscription but I can > download the free 1-month-old rules tarball using the 'sub-rules' URL > with my oinkcode.
Thanks for clarifying this. I use paid subscriptions and didn't have a chance to register a new account and test with a non-paid oink code. Without the clarification, some confusion could arise in the future. For example, when a new Snort release occurs (let's call it 2.9.4), snortrules-snapshot-2940.tar.gz will exist only for the 'sub-rules' set for the first 30 days. I'm not sure what happens when a non-paid oink code tries to hit grab a paid ruleset that doesn't have a corresponding non-paid version. --avj