<![CDATA[NOTICE: Snort or Suricata users with ET-Pro subscriptions or using ET-Open rules]]>UPDATE:  You may or may not be impacted by this.  I have one user who reported a problem, but I tested a virtual machine I have and it still works fine.  Both versions of the URL still resolve and work on my testing VM.  So if you are not noticing a problem with ET rule updates, ignore this post.

Users of Emerging Threats rules with  the Snort package may encounter issues downloading rule updates.  It seems the download URL construction recently changed.  The URL includes a Snort version string that was "2.9.0" but appears to have recently changed to "2.9.7".

If you are not getting Emerging Threats rule updates, you can make the following file edit on your system while awaiting a patch.

Edit the file /usr/local/pkg/snort/snort_defs.inc.

Find this section of code:


if (!defined("ET_VERSION"))
	define("ET_VERSION", "2.9.0");

and change it to read as follows:


if (!defined("ET_VERSION"))
	define("ET_VERSION", "2.9.7");

I will push a permanent fix for this soon.

Bill

]]>https://forum.netgate.com/topic/80496/notice-snort-or-suricata-users-with-et-pro-subscriptions-or-using-et-open-rulesRSS for NodeWed, 15 Jul 2026 10:48:40 GMTSat, 28 Feb 2015 04:18:16 GMT60<![CDATA[Reply to NOTICE: Snort or Suricata users with ET-Pro subscriptions or using ET-Open rules on Sat, 28 Feb 2015 15:15:38 GMT]]>Mine had updated automatically last might at midnight as schedule but I did a manual update just to check it and see.

Both seem to be functioning normally for me.

]]>https://forum.netgate.com/post/523700https://forum.netgate.com/post/523700Sat, 28 Feb 2015 15:15:38 GMT<![CDATA[Reply to NOTICE: Snort or Suricata users with ET-Pro subscriptions or using ET-Open rules on Sat, 28 Feb 2015 14:13:16 GMT]]>@Jailer:

Working fine for me with the ET open rules. Just tried it again manually to make sure and it's working.

Thanks for the verification.  It may be an isolated problem.  The user who reported it had just recently renewed his ET-Pro subscription (but his subscriber code did not change).  Don't know if that had anything to do with it or not.  He is working with Emerging Threats tech support.

If your ET rules are continuing to update normally, then no file edit is necessary.  Usually the ET rules have an update daily.

Bill

]]>https://forum.netgate.com/post/523683https://forum.netgate.com/post/523683Sat, 28 Feb 2015 14:13:16 GMT<![CDATA[Reply to NOTICE: Snort or Suricata users with ET-Pro subscriptions or using ET-Open rules on Sat, 28 Feb 2015 05:01:31 GMT]]>Working fine for me with the ET open rules. Just tried it again manually to make sure and it's working.

]]>https://forum.netgate.com/post/523616https://forum.netgate.com/post/523616Sat, 28 Feb 2015 05:01:31 GMT