pulledpork
pulledpork copied to clipboard
Does not complete process in terminal window 0.7.1 in Windows
PP 0.7.0 completes normally in the terminal window. However PP 0.7.1 does not. My run line for PP is 'perl d:\winids\pulledpork\pulledpork.pl -c d:\winids\pulledpork\etc\pulledpork.conf -vvT > d:\output.txt'. I'm using the same configuration settings in both versions of the pulledpork.conf file.
After a lot of time has past on a new run PP exits in the terminal window with some errors.
-----------------------------------
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Operator>perl d:\winids\pulledpork\pulledpork.pl -c d:\winids\pulledpork\etc\pulledpork.conf -vvT > D:\temp\output.txt 'uname' is not recognized as an internal or external command, operable program or batch file. ** GET https://www.snort.org/reg-rules/snortrules-snapshot-2972.tar.gz.md5/b6395cce08f5020ed5b27366ac0fcbdcce33be65 ==> 200 OK (3s) ** GET https://www.snort.org/reg-rules/snortrules-snapshot-2972.tar.gz/b6395cce08f5020ed5b27366ac0fcbdcce33be65 ==> 302 Found ** GET https://s3.amazonaws.com/snort-org-site/production/release_files/files/000/001/658/original/snortrules-snapshot-2972.tar.gz?AWSAccessKeyId=AKIAIXACIED2SP MSC7GA&Expires=1429934577&Signature=rVGBP7oJCyFMuTTIPW%2FhpXlSSvw%3D ==> 200 OK (18s) ** GET https://s3.amazonaws.com/snort-org/www/rules/community/community-rules.tar.gz.md5 ==> 200 OK ** GET http://labs.snort.org/feeds/ip-filter.blf ==> 200 OK ** GET https://www.snort.org/reg-rules/opensource.gz.md5/b6395cce08f5020ed5b2736 6ac0fcbdcce33be65 ==> 200 OK No such file in archive: 'doc/signatures/community-rules/VRT-License.txt' at d:\winids\pulledpork\pulledpork.pl line 293 Could not find an entry for 'doc/signatures/community-rules/VRT-License.txt' at d:\winids\pulledpork\pulledpork.pl line 293 No such file in archive: 'doc/signatures/rules/VRT-License.txt' at d:\winids\pulledpork\pulledpork.pl line 293 Could not find an entry for 'doc/signatures/rules/VRT-License.txt' at d:\winids\pulledpork\pulledpork.pl line 293 readline() on closed filehandle DATA at d:\winids\pulledpork\pulledpork.pl line 577. readline() on closed filehandle DATA at d:\winids\pulledpork\pulledpork.pl line 577. readline() on closed filehandle DATA at d:\winids\pulledpork\pulledpork.pl line 577.
C:\Users\Operator> -----------------------------------/ I don't get the above running 0.7.0, as 0.7.0 exits cleanly.
On the initial run I had PP redirect output to a file and it looks like everything completed successfully.
-----------------------------------
Cleanup....
removed 121 temporary snort files or directories from d:\winids\pulledpork\temp/tha_rules!
Activating security rulesets....
Done
Modifying Sids....
Done!
Processing d:\winids\pulledpork\etc\enablesid.conf....
Modified 0 rules
Done
Processing d:\winids\pulledpork\etc\dropsid.conf....
Modified 0 rules
Done
Processing d:\winids\pulledpork\etc\disablesid.conf....
Modified 0 rules
Done
Setting Flowbit State....
Enabled 775 flowbits
Enabled 25 flowbits
Enabled 4 flowbits
Enabled 2 flowbits
Done
Writing d:\winids\snort\rules\winids.rules....
Done
Generating sid-msg.map....
Done
Writing v1 d:\winids\snort\etc\sid-msg.map....
Done
Writing d:\winids\snort\log\sid_changes.log....
Done
Rule Stats...
New:-------24103
Deleted:---0
Enabled Rules:----9367
Dropped Rules:----0
Disabled Rules:---14736
Total Rules:------24103
No IP Blacklist Changes
Done Please review d:\winids\snort\log\sid_changes.log for additional details Fly Piggy Fly! -----------------------------------/
It appears all the files gets processed (.rules, sid-msg.map) correctly and completely.
Does the current master repo still do this?