Default Snort Rules and Classes

125

The script uses a configuration file where many options can be configured. Specif 

ically you can configure the following in the configuration file oinkmaster.conf:

  URL of the location from where it downloads the Snort rules. By default this

URL is http://www.snort.org/downloads/signatures/snortrules.tar.gz or http://

www.snort.org/downloads/snortrules.tar.gz. This is configured using the url

keyword in the configuration file.

  Files to be updated. By default files ending with  .rules, .config, .conf,

.txt and .map are updated and all other files are ignored. This is done using

the update_files keyword.

  Files to be skipped when updating rules. This is done using the skipfile

keyword. You can use as many skipfiles lines as you like. This option is useful

when you have customized rules in some files. When you skip these files, your

customized rules will not be overwritten during the update process.

  You can disable certain rules permanently using the disablesid keyword in the

configuration file. The tool will not update these rules during the update.

Please use the README and INSTALL files that come with the tool. You can use

this tool from a cron script to periodically update your rule set.

3.10 Default Snort Rules and Classes

Snort comes with a rich set of rules. These rules are divided into different files. Each

file represents one class of rules. In the source code distribution of Snort, these files are

present under the rules directory in the source code tree. The following is a list of the

rule files in Snort 1.9.0 distribution:

attack responses.rules

backdoor.rules

bad traffic.rules

chat.rules

ddos.rules

deleted.rules

dns.rules

dos.rules

experimental.rules

exploit.rules

finger.rules

ftp.rules

icmp info.rules

icmp.rules