readme

This is the snapshot of Snot Latest Rules

Overview
--------
Due to contract terms with some 3rd party research organizations, a
small number of VRT certified rules will only be delivered as binaries.

This applies only to shared object (SO) rules. Non-shared object rules
WILL NOT be affected. Additionally, because of this change and to better
serve the Snort community the VRT will pre-compile the "SO" rules so
they are easier to use on the various platforms utilized by the snort
community and the VRT subscribers.

Directory Structure
-------------------
The structure of the "so_rules" directory inside the rule is as follows:

so_rules/
	src/
	precompiled/
               <distro>/
                        <platform>/
                                   <snort-version>

Where:
<distro> is one of the following values:
  a. CentOS-4.6
  b. CentOS-5.1
  c. FC-5
  d. OSX-10.4
  e. ubuntu-6.01.1

<platform> is one of the following values:
  a. i386

<snort-version> is one of the following values
  a. 2.6.1.5
  b. 2.7.0
  c. 2.8.0.1
  d. 2.8.0.2
  e. 2.8.1

If your platform/distribution is not currently listed above this does
not mean these shared objects won't work on your platform.  Numerous
Linux distributions share common libc versions and it is possible that
one of the above distributions and platforms will work on your system.
If none of the above combinations work on your platform, please send a
note to the snort-sigs mailing list so we can determine the need for
additional platforms and distributions to be added to the list of
supported platforms.

WARNING
-------
Sourcefire VRT rule packs often utilize enhancements made to Snort.
Operators should upgrade to the latest revision or patch level for Snort
to ensure these enhancements are available before using these rules.

IMPORTANT
---------
These rules WILL NOT WORK if the options "--enable-ipv6" or
"--enable-gre" have been used in the configure arguments for your Snort
installation.