Re: Duplicates: How does snort select "older rules"?

Revision number.


Albert Lewis

Email: [email protected]<mailto:[email protected]>

________________________________
From: Snort-users <[email protected]> on behalf of Goesele, Andreas <[email protected]>
Sent: Saturday, January 6, 2024 12:55 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] Duplicates: How does snort select "older rules"?

I'm using together the community rules (community-rules.tar.gz) and the
free (for registered users) rules of snortrules-snapshot-29200.tar.gz. I
understand that this is recommended for those using only free
rule-sets.

This leads to a large number of duplicates. The warnings look like this:

WARNING: /etc/snort/rules/exploit-kit.rules(206) GID 1 SID 32386 in rule
duplicates previous rule. Ignoring old rule.

I would like to know how snort determines what is the older rule.

1. There is no consistent versioning information in the respective
rule-sets. So this can't be the criterion.

2. One criterion could be the time of modification of the respective
file. (In my case this would mean that the community-rules are used.)

3. But the example message could also mean, that the rule mentioned
(here from exploit-kit.rules) is used.

4. There might be other possibilities ...

I searched a lot, but didn't find any answer to this question.

Additionally: Whatever is the criterion what is its justification?

Thanks a lot in advance!
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette