Re: Snort duplicate signatures in table

[Dirk Geschke <Dirk_Geschke () genua de>]

Hi Vladimir,

> Apr 18 19:10:58 gw1 snort[29259]: database: warning (SELECT sig_id   FROM
> signature  WHERE sig_name = 'WEB-MISC Cisco IOS HTTP configuration attempt'
> AND sig_rev = 13    AND sig_sid = 1250 ) returned more than one result
>
> This mean that packet going over 2 interfaces and on each snort detect
> suspicious traffic. Then snort execute 2 concurrent SELECT queries(1 by each
> snort process) to see does the signature exists in signature database. And
> then snort try to insert signature.
> I know that signature table does not have duplicated signatures but I don't
> know how to solve this problem.

are you sure about this? Maybe there are more rules with the same sig_name,
sig_rev and sig_sid but with different priorities?

Simply connect to the database and execute the SQL statement. Then you can
easily see which other results are available. Use psql to connect to the
database and then execute:

SELECT * FROM signature WHERE sig_name = 'WEB-MISC Cisco IOS HTTP configuration attempt' AND sig_rev = 13 AND sig_sid = 
1250;

This should show all results with all fields. And probably you will find the
answer what caused the above message...

Best regards

Dirk



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users