Re: snort signature analysis tools

[Martin Roesch <roesch () sourcefire com>]

What do you mean by overlaps/collisions?  Rules that cover the same  
attack, duplicates, rules that will "cover" other rules and prevent  
them from firing?


On Jan 4, 2005, at 1:16 PM, Scott Kelly wrote:

> Does anyone know of any tools to analyze a batch of snort signatures  
> for
> overlaps/collisions?
>
>
>
> ----------------------------------------------------------------------- 
> ---
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to  
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ----------------------------------------------------------------------- 
> ---
--
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Discover.  Determine.  Defend.
roesch () sourcefire com - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------