Re: Snort 2.8 and SID on pass- and alert-rules

["David J. Bianco" <david () vorant com>]

You've never been allowed to have duplicate SIDs, unless they both also
have the "rev:" tag to indicate revision.  In that case, only the highest
revision will be used.  You didn't really say, but do both of your rules
have "rev:" tags?

BTW, if you're going to do this, you might as well just disable the
original rule entirely.  If you're going to pass the matching traffic,
it's just more efficient to not have the rule at all.
        
        David

Vidar Hoel wrote:
> Hi,
>
> We have just tried Snort 2.8 on one of our test-sensors, and discovered
> a new "feature" not mentioned in the release notes:
>
> As an example: In our ruleset, we have one alert-rule with SID 1234. But
> for this rule, we create some pass-rules, also with SID 1234. This way
> it's easy to keep tracking of which pass-rules an alert-rule have, and
> vice versa.
>
> But with Snort 2.8, this is not possible. Snort 2.8 will not start, and
> complain that we already have a rule with SID 1234.
>
> What is the reason for this change, since it's not mentioned in the
> release notes? Or is it just a bug?

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users