Re: Duplicates: How does snort select "older rules"?

Al is right.  The revision number is the thing that tells the engine “when loading two of the same SID, use the highest revision number first.  If the revision number is the same, then use the FIRST rule you ran across when doing the load”.

The community ruleset (I believe) updates daily.  Whereas the official ruleset updates twice a week.  (Well it used to, I haven’t followed along closely since I left Cisco)

> On Jan 9, 2024, at 10:37, Al Lewis (allewi) via Snort-users <[email protected]> wrote:
> 
> Revision number.
> 
> Albert Lewis
> Email: [email protected] <mailto:[email protected]> 
> From: Snort-users <[email protected]> on behalf of Goesele, Andreas <[email protected]>
> Sent: Saturday, January 6, 2024 12:55 AM
> To: [email protected] <[email protected]>
> Subject: [Snort-users] Duplicates: How does snort select "older rules"?
>  
> I'm using together the community rules (community-rules.tar.gz) and the
> free (for registered users) rules of snortrules-snapshot-29200.tar.gz. I
> understand that this is recommended for those using only free
> rule-sets.
> 
> This leads to a large number of duplicates. The warnings look like this:
> 
> WARNING: /etc/snort/rules/exploit-kit.rules(206) GID 1 SID 32386 in rule
> duplicates previous rule. Ignoring old rule.
> 
> I would like to know how snort determines what is the older rule.
> 
> 1. There is no consistent versioning information in the respective
> rule-sets. So this can't be the criterion.
> 
> 2. One criterion could be the time of modification of the respective
> file. (In my case this would mean that the community-rules are used.)
> 
> 3. But the example message could also mean, that the rule mentioned
> (here from exploit-kit.rules) is used.
> 
> 4. There might be other possibilities ...
> 
> I searched a lot, but didn't find any answer to this question.
> 
> Additionally: Whatever is the criterion what is its justification?
> 
> Thanks a lot in advance!
> _______________________________________________
> Snort-users mailing list
> [email protected]
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
> 
>         To unsubscribe, send an email to:
>         [email protected]
> 
> Please visit http://blog.snort.org <http://blog.snort.org/> to stay current on all the latest Snort news!
> 
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
> _______________________________________________
> Snort-users mailing list
> [email protected] <mailto:[email protected]>
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
> 
> 	To unsubscribe, send an email to:
> 	[email protected] <mailto:[email protected]>
> 
> Please visit http://blog.snort.org <http://blog.snort.org/> to stay current on all the latest Snort news!
> 
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette