Snort raw rule downloads
jeffhammett last edited by
When the pfSense Snort package downloads rule updates, does it save the raw files (either the tarball it downloads from Snort/ET, or the extracted files from those tarballs) somewhere accessible via SSH?
I find that sometimes it's easier to grep a rule file for a specific rule to see references, etc. than it is to do so through the web gui.
bmeeks last edited by
The entire tarball is not saved (it is downloaded to and extracted in a folder under /tmp and then deleted). However, the individual rules files (category files) extracted from the raw tarball are save here on the firewall: /usr/pbi/snort-amd64/etc/snort/rules. Change the amd64 to i386 if you have a 32-bit install.