Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been working on getting my snort machine up and running, and working through Snort IDS and IPS Toolkit.

The authors suggest using Oinkmaster, but on that website, the last update was February of 2008. That seems sort of...odd. Maybe there haven't been any issues with oinkmaster in the past year and a half, but it made me wonder if there was another solution that I don't know about.

If you use snort, do you automatically update your rules, and if so, how?

share|improve this question
Even though oinkmaster hasn't been updated in a long time, it is such a simple program that it doesn't need constant updates. – Scott Pack Nov 16 '09 at 16:43
up vote 1 down vote accepted

Pulled Pork is now considered the recommended rule updating system for Snort. While it is not an official Sourcefire product, it is developed by a Sourcefire employee.

The syntax is slightly more complicated than oinkmaster, however a contributed script,, will read in your oinkmaster config and convert it to pulledpork syntax making system conversions much easier.

In addition to update standard rules, it is also capable of managing the so_rules that were previously a manual process.

share|improve this answer

Oinkmaster is the recommended and best way to keep your rules updated. It is a simple script that's why it hasn't been updated in a while.

This is a good howto:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.