Duplicates: How does snort select "older rules"?

I'm using together the community rules (community-rules.tar.gz) and the
free (for registered users) rules of snortrules-snapshot-29200.tar.gz. I
understand that this is recommended for those using only free
rule-sets.

This leads to a large number of duplicates. The warnings look like this:

WARNING: /etc/snort/rules/exploit-kit.rules(206) GID 1 SID 32386 in rule
duplicates previous rule. Ignoring old rule.

I would like to know how snort determines what is the older rule.

1. There is no consistent versioning information in the respective
rule-sets. So this can't be the criterion.

2. One criterion could be the time of modification of the respective
file. (In my case this would mean that the community-rules are used.)

3. But the example message could also mean, that the rule mentioned
(here from exploit-kit.rules) is used.

4. There might be other possibilities ...

I searched a lot, but didn't find any answer to this question.

Additionally: Whatever is the criterion what is its justification?

Thanks a lot in advance!
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette