<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p><br></p><blockquote type="cite">On November 30, 2017 at 11:24 AM Erich Lerch <erich.lerch@gmail.com> wrote:<br><br><div dir="ltr"><div><em>The fork absolutely DOES make sense. You say that rules failing to load on older versions of Suri are no big issue, Suricata will still run. It will run, but I won't get the alerts from the rules that failed, which IS an issue.</em></div></div></blockquote><p>If those certain rules are written to use the features provided for by V4, why does it matter if they are not active on <V4? If you want them in you will upgrade to V4.<br></p><blockquote type="cite"><div dir="ltr"><div><em>If I still have the opportunity to load rules covering the same issues, but maybe without using the latest rule keywords, I'm happy to have them available, at least for a certain period.</em></div></div></blockquote><p>If they are not forked, they would still be available! Its no different from having multiple rules for addressing the same issue as we currently do.....there are already so many rules in the repositories with various revisions. <br></p><p>BTW, I was talking about logistics of rule management in a multiple, mixed versions, installations scenario as opposed to suggesting that we stop writing rules for 3.2!<br></p><p><br></p><blockquote type="cite"><div dir="ltr"><div><em>Cheers,</em></div><div><em>Erich</em></div></div></blockquote><p>regards<br>Amar<br></p><blockquote type="cite"><div class="ox-bf01318071-gmail_extra"><div class="ox-bf01318071-gmail_quote">2017-11-30 15:14 GMT+01:00 Amar Rathore - CounterSnipe Systems <<a href="mailto:amar@countersnipe.com" target="_blank" rel="noopener noreferrer">amar@countersnipe.com</a>>:<br><blockquote><u></u><div><p>Hi Folks<br></p><p>In the light of on going rule fork email exchanges, I wanted to bring the following brief conversation, between Francis and me, back into wider circulation.</p><p>I think generally speaking, we can do with more preciseness in directional/strategy type responses, more coordinated messaging and most definitely longer notices of changes. That said, I know it is all open source, and people are busy and its not always possible to fit everything in. So thank you to all of the team that makes this great IDE possible.<br></p><p>So to the rules thing, I still don't understand the reason for forking them. They didn't need to be forked off from 1 to 2 to 3 to 3.2 so why now? All the conversations so far are displaying confusion for anyone considering using Suricata....you know all the new people that don't necessarily join in in the conversations. <br></p><p>Going by Francis's response below, there will actually be no big issue even if you were to use 4.0 rule set with previous versions of Suri.<br></p><p>My concern was that in a mixed environment of Suri Versions, and a central rule management system, you could run into problems. But the good news is that won't be the case. <br></p><p>Commercial Software like CounterSnipe, can easily check the running version and load a rule set accordingly. I am not sure if that could be implemented within Suricata's future releases. The other point will be if Suricata already handles "not run but error" part elegantly enough, then there is no real issue and such option might not even be necessary! You could simply disable all of the rules specific to V4, until you upgrade.<br></p><p>Best<br></p><p>Amar<br></p><blockquote type="cite">On November 27, 2017 at 5:04 PM Francis Trudeau wrote:<br><br><br>In a sense, yes. We are starting to use keywords and features of<br>Suricata 4.0 in the 4.0 branch. If the new style rules are loaded in<br>Suricata < 4, they will probably error.<br><br>It won't cause a sensor to go down, but it won't be able to run the<br>rules with the new stuff. It will basically false negative on the<br>traffic those rules were meant for.<br><br>Let me know if that makes sense.<br><br>-FT<br><br><br><br><br><br><br><br>On Mon, Nov 27, 2017 at 6:28 AM, Amar Rathore - CounterSnipe Systems<br> wrote:<blockquote type="cite">Hello Francis<br><br>Does your message imply non compatibility between <4.0 and 4.0?<br><br>In that case what will happen to mixed setups?<br><br>regards<br><br>Amar<br><br>On November 21, 2017 at 1:24 PM Francis Trudeau<br> wrote:<br><br>Please use your version in your rule download. We use this to track who is<br>running what.<br><br>For example, if you are using Suricata 4.0 use:<br><br><a href="https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz" target="_blank" rel="noopener noreferrer">https://rules.emergingthreats.<wbr/>net/open/suricata-4.0/<wbr/>emerging.rules.tar.gz</a>.<br><br>Including the version will get you the correct ruleset for your version if<br>we make changes. We use rewrite rules to steer requests correctly. We are<br>forking the set today, and this will ensure you get the correct rules.<br><br>Thanks,<br><br>Francis<br><br><br><br><br><br><br><br>On Mon, Nov 20, 2017 at 2:12 PM, dev wrote:<br><br><br><br>On 11/20/2017 01:52 PM, Victor Julien wrote:<blockquote type="cite">Perhaps you can try the https url instead? Same url but https.</blockquote>Yes, HTTPS works well. I will use that.<br>Thank you<br>______________________________<wbr/>_________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank" rel="noopener noreferrer">oisf-users@<wbr/>openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" target="_blank" rel="noopener noreferrer">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank" rel="noopener noreferrer">http://suricata-ids.org/<wbr/>support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank" rel="noopener noreferrer">https://lists.<wbr/>openinfosecfoundation.org/<wbr/>mailman/listinfo/oisf-users</a><br><br>Conference: <a href="https://suricon.net" target="_blank" rel="noopener noreferrer">https://suricon.net</a><br>Trainings: <a href="https://suricata-ids.org/training/" target="_blank" rel="noopener noreferrer">https://suricata-ids.org/<wbr/>training/</a><br><br><br>______________________________<wbr/>_________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank" rel="noopener noreferrer">oisf-users@<wbr/>openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" target="_blank" rel="noopener noreferrer">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank" rel="noopener noreferrer">http://suricata-ids.org/<wbr/>support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank" rel="noopener noreferrer">https://lists.<wbr/>openinfosecfoundation.org/<wbr/>mailman/listinfo/oisf-users</a><br><br>Conference: <a href="https://suricon.net" target="_blank" rel="noopener noreferrer">https://suricon.net</a><br>Trainings: <a href="https://suricata-ids.org/training/" target="_blank" rel="noopener noreferrer">https://suricata-ids.org/<wbr/>training/</a><br><br><br>Kind regards<br><br>Amar Rathore<br><br>CounterSnipe Systems LLC<br>Tel: +1 617 701 7213<br>Mobile: +44 (0) 7876 233333<br>Skype ID: amarrathore<br>Web: <a href="http://www.countersnipe.com" target="_blank" rel="noopener noreferrer">www.countersnipe.com</a> <br><br>This message contains confidential information and is intended only for the<br>individual named. If you are not the named addressee you should not<br>disseminate, distribute or copy this e-mail. Please notify the sender<br>immediately by e-mail if you have received this e-mail by mistake and delete<br>this e-mail from your system.<br><br>E-mail transmission cannot be guaranteed to be secure or error-free as<br>information could be intercepted, corrupted, lost, destroyed, arrive late or<br>incomplete, or contain viruses. The sender therefore does not accept<br>liability for any errors or omissions.</blockquote></blockquote><p><br></p><div class="ox-bf01318071-m_-1403639956621159219io-ox-signature"><p>Kind regards<br></p><p>Amar Rathore</p><p>CounterSnipe Systems LLC <br>Tel: +1 617 701 7213 <br>Mobile: +44 (0) 7876 233333 <br>Skype ID: amarrathore <br>Web: <a href="http://www.countersnipe.com" target="_blank" rel="noopener noreferrer">www.countersnipe.com</a> <<a href="http://www.countersnipe.com/" target="_blank" rel="noopener noreferrer">http://www.countersnipe.com/</a>> <br><br></p><p><span style="font-size: 8pt;">This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.</span></p><p><span style="font-size: 8pt;">E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions.</span> <br></p></div></div><br>______________________________<wbr/>_________________<br> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@<wbr/>openinfosecfoundation.org</a><br> Site: <a href="http://suricata-ids.org" target="_blank" rel="noopener noreferrer">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank" rel="noopener noreferrer">http://suricata-ids.org/<wbr/>support/</a><br> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank" rel="noopener noreferrer">https://lists.<wbr/>openinfosecfoundation.org/<wbr/>mailman/listinfo/oisf-users</a><br> <br> Conference: <a href="https://suricon.net" target="_blank" rel="noopener noreferrer">https://suricon.net</a><br> Trainings: <a href="https://suricata-ids.org/training/" target="_blank" rel="noopener noreferrer">https://suricata-ids.org/<wbr/>training/</a><br></blockquote></div><br></div>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br><br>Conference: https://suricon.net<br>Trainings: https://suricata-ids.org/training/</blockquote><p><br></p><div class="io-ox-signature"><p>Kind regards<br></p><p>Amar Rathore</p><p>CounterSnipe Systems LLC <br>Tel: +1 617 701 7213 <br>Mobile: +44 (0) 7876 233333 <br>Skype ID: amarrathore <br>Web: www.countersnipe.com <http://www.countersnipe.com/> <br><br></p><p><span style="font-size: 8pt;">This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.</span></p><p><span style="font-size: 8pt;">E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions.</span> <br></p></div></body></html>