Just a quick update .. in case you have not heard, the bleeding edge community site (bleedingthreats.net) is no longer in service. However a new site/group has emerged to take it’s place. For all your bleeding edge snort rules, you will need to update your bookmarks and oinkmaster.conf for the new site, which is http://emergingthreats.net.

For those of you who have upgraded to Snort 2.8.0, I have a quick tip for you. If you hadn’t heard yet, Snort no longer supports the use of the dsize directive within snort rules. Thankfully, the existing rules that use this directive, don’t cause Snort to crash. However, as we all know, the fewer rules Snort has to process, the better it performs. So how do you disable all the rules that use dsize?

It’s really more simple then you might think.