On Mon, Jul 11, 2011 at 8:31 AM, Negin Nickparsa <nickparsa@xxxxxxxxx>wrote: > I'm in opensuse I tried wget url for another site it is working > there(without -O) > > for example I can have this: > > wget http://library.linode.com/assets/695-wget-example.txt > > and it is working it will be downloaded on /root > > but I'm so confused about snort rules that why I can't download them > I also tried this without -o: > > > > wget > http://www.snort.org/reg-rules/snortrules-snapshot-2900.tar./c0e9480af637e53c7aae823a40a131edc1343db5 > --11:32:01-- > http://www.snort.org/reg-rules/snortrules-snapshot-2900.tar.gz/c9480af637e53c7aae823a40a131edc1343db5 > => `c0e9480af637e53c7aae823a40a131edc1343db5' > Resolving www.snort.org... 68.177.102.20 > Connecting to www.snort.org|68.177.102.20|:80... connected. > HTTP request sent, awaiting response... 302 Found > Location: > http://s3.amazonaws.com/snort-org/www/rules/20110208/snortrules-snapot-2900.tar.gz?AWSAccessKeyId=AKIAJJSHU7YNPLE5MKOQ&Expires=1310368612&Signatur4%2FmK3rg3f%2FXFi5VhOm%2FjCW%2BcBSM%3D > [following] > --11:32:04-- > http://s3.amazonaws.com/snort-org/www/rules/20110208/snortrules-apshot-2900.tar.gz?AWSAccessKeyId=AKIAJJSHU7YNPLE5MKOQ&Expires=1310368612&Signure=4%2FmK3rg3f%2FXFi5VhOm%2FjCW%2BcBSM%3D > => > `snortrules-snapshot-2900.tar.gz?AWSAccessKeyId=AKIAJJSHU7YNPLE5OQ&Expires=1310368612&Signature=4%2FmK3rg3f%2FXFi5VhOm%2FjCW+cBSM=' > Resolving s3.amazonaws.com... 72.21.214.143 > Connecting to s3.amazonaws.com|72.21.214.143|:80... connected. > HTTP request sent, awaiting response... 403 Forbidden > 11:32:10 ERROR 403: Forbidden. > > again error the file is empty > It says it right there... ERROR 403: Forbidden. According to http://www.snort.org/snort-rules you need to be a subscriber or registered user to download the rules, so there is some form of validation on the download URL. In the example you give I'm guessing it's the c0e9480af637e53c7aae823a40a131edc1343db5. That means you can't simply download from that URL, you'll need to programatically log into the website, find the link and then do the download. -Stuart -- Stuart Dallas 3ft9 Ltd http://3ft9.com/
