Snort.org Ecommerce

The Snort Subscription Store has been experiencing intermittent issues.  The store is temporarily disabled to perform maintenance.  We will announce the return of availability on the snort.org blog at http://blog.snort.org. 

 In the meantime, please email snort-sub@sourcefire.com to process your transaction or call 1-866-505-913 or +1-734-743-6550 for manual processing.

Snort.org restoration

We are still experiencing some problems with certain aspects of Snort.org, however, for most things (such as rule downloads) should be in proper functioning order.  I'll keep you posted on the status of the site.

Thanks for being patient.

Some current Snort.org errors

We are getting reports of 500 errors when trying to sign up on Snort.org.  Thank you.

We're aware of the issue and the site is currently undergoing some maintenance to make things faster and sustainable for the long term.

I'll update the blog when things seem to be resolved.

Decommissioning of the CVS Server at Snort.org

For years we've had a underused CVS server at the location of cvs.snort.org.  While going back through our assets and taking a look at what we were using and not using, we noticed that cvs.snort.org was barely used.  The server was very old and ran an older OS, so at this point it was becoming more of a liability to keep it up.

This wasn't even a live CVS server and it was only synced when we did a Snort release.

In fact, the only time it was ever used was when people Google a phrase and wind up in the code repository to reference something on a Snort list.  Since the posting of the manual at http://manual.snort.org I felt the server was unneeded and it is now in the process of being decommissioned.  In fact, it's already been brought down.

If people still need the CVS, let me know, and we will explore ways to make the code public in a CVS form again.  You can still download the full source code of Snort at https://www.snort.org/downloads.

A Comparison of 3 Popular Snort GUIs

James Lay, an outstanding Snort Community Member, sent me this great comparison of three popular Snort GUIs:

• BASE 1.4.5
• Snorby 2.3.9
• SQueRT 0.9.2

I've posted it on http://snort.org/docs as well, but for those of you that would like a direct link:

https://www.snort.org/documents/29

I'd like to take the time to thank James for the time he took to set all three of these up and compare the two.

If anyone would like to add another Snort GUI that you use to this matrix, please send me the name of the product, version, and the points as laid out in the document.  If you'd like to add some fields, that'd be fine too.

First 2011 Snort Webcast has been posted!

Today, April 13, 2011, Nick Moore of our Security Engineering group at Sourcefire presented on the Intro to Installing Snort.  This webcast was recorded and is now available for consumption, along with the rest of the past Webcast recordings over at: http://www.snort.org/webcast_series.

Our next webcast is currently scheduled for May 25, 2011 with John Gay, one of our Instructors from the Education department here at Sourcefire.  I'll be sure and post reminders, but be sure and mark your calendars.

Snort Webcast Series is back

When I took over the OpenSource Community Manager position here at Sourcefire, I sent out an email asking for suggestions about what I can do to make things better and provide an awesome community for the OpenSource products.

One of the things that was emailed to me was "Can you put the Snort Webcast Series back up?"  and "Start the webinar series back up!".  So, I did, and we will.

You can find the old series that Mike Guiterman (thanks Mike!) was coordinating back in 2009, re-released and put up on Snort.org.  It's always been available, but over on Sourcefire.com where you had to register to view the content.  This is one of the other complaints I received, that people had to surrender their email to the website in order to gain access to this valuable information.

So I removed that restriction as well.

So, announcing without further ado, the old series is back up, and we're going to be reviving the series soon (probably once a month or so), and putting that information up for consumption as well.  As always I'll post a blog entry when we are going to schedule a webcast, so you may participate live and ask questions of the speakers, and I'll post a blog entry when we put it up on the website for archiving.

You can find the Snort webcast series here, at it's new home, on Snort.org.

Improving your Custom Snort Rules -- New Whitepaper Posted

Originally posted in December's hackin9 magazine, Leon Ward authored this paper entitled "Improving your Custom Snort Rules".  We've just added this document to the http://www.snort.org/docs page under "Snort Related Whitepapers".

So be sure and check it out.

Thanks go out to Leon Ward, Alex Kirk, and Dave Venman of Sourcefire for this document.

Snort 2.9.0.4 install guide for Slackware 13.1 and OpenBSD 4.8 posted

Randal Rioux is our first documenter out of the gate with Snort 2.9.0.4 with an install guide for not only Slackware 13.1 but also OpenBSD 4.8!  Nice Job Randal!

Be sure and check out his guides at http://snort.org/docs

We're going to send Randal out some Snort swag!

Thanks to all of our Snort community contributors on their documentation, if you'd like to contribute some documentation and have it hosted on http://snort.org/docs, please feel free to contact me at joel@snort.org, and if we put your guides/whitepapers up on the site, we'll send you some Snort swag!

White Papers on Snort.org

We just wanted to point to a new section that we're putting together on Snort.org, a whitepapers section.  Previously we've had about three different pages on Snort.org that contained this type of content.   In the process of cleaning up the Snort.org website and bringing the information that people need to the front and more organized, we've created a new section on the Documentation section on Snort.org.

If you visit the bottom of http://www.snort.org/docs, you'll see a new section entitled "Snort Related Whitepapers".  Over time we'll consolidate more and more whitepaper-type content into this section and try and keep it updated with information.  A couple of the papers on there currently are rather old, however, their content is still very relevant, and it may help the users of Snort to understand the internals of how the tool works.

Please check out this section.  We should be adding several more papers soon.

In addition I've received several emails asking when we are going to restart the webinar series that we were using to teach content.  My answer is soon.  Sorry I can't give you a better date, but I want to make sure we have great content.

If you have suggestions for content you'd like to see on the webinar series or the whitepaper section, please feel free to leave a comment.  Thanks

OpenBSD Snort 2.9.0.3 setup guide

Just added to http://snort.org/docs, another awesome setup guide from the Snort community, covering the latest version of Snort (2.9.0.3) on OpenBSD.

I'd like to thank Randal Rioux for his guide, as I know that takes a lot of time to write up.  We are always on the lookout for more setup guides, whitepapers, and how-to's from the community.  If you are interested in writing one, please contact me, and I will help you in anyway I can.
joel [at] snort.org

Thanks Randal!