Snort mailing list archives
Re: Duplicate sid:257; ????
From: Brian <bmc () snort org>
Date: Tue, 16 Apr 2002 13:59:33 -0400
According to Stephen Cravey:
I was under the impression that no two signatures should have the same SID. While perusing the snort rules, however, I came across SID # 257 in dns.rules. There are two different versions of this signature in the file. alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named version attempt"; flags:A+; content:"|07|version"; offset:12; content:"|04|bind"; nocase; offset: 12; reference:arachnids,278; classtype:attempted-recon; sid:257; rev:2;) alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named version attempt"; content:"|07|version"; offset:12; content:"|04|bind"; nocase; offset: 12; reference:arachnids,278; classtype:attempted-recon; sid:257; rev:1;) Is this correct? I'm trying to write some signature management code for myself and this pretty much stopped me in my tracks. I got the file from http://www.snort.org/dl/signatures/snortrules.tar.gz this afternoon. What does snort do when it encounters this?
This has been corrected in CURRENT. I've just corrected it in stable. Give it about 2 hours and the version available on the website should be corrected. -brian _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Duplicate sid:257; ???? Stephen Cravey (Apr 16)
- Re: Duplicate sid:257; ???? Brian (Apr 16)