Re: Snort-users Digest, Vol 132, Issue 24

[Mohammed Salami <m.salami () hotmail co uk>]

Hello

How can I test snort performance ? like CPU and memory when attack happen 

thanks
mo
> On 21 May 2017, at 19:13, snort-users-request () lists sourceforge net wrote:
>
> Send Snort-users mailing list submissions to
>       snort-users () lists sourceforge net
>
> To subscribe or unsubscribe via the World Wide Web, visit
>       https://lists.sourceforge.net/lists/listinfo/snort-users
> or, via email, send a message with subject or body 'help' to
>       snort-users-request () lists sourceforge net
>
> You can reach the person managing the list at
>       snort-users-owner () lists sourceforge net
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Snort-users digest..."
>
>
> When responding, please don't respond with the entire Digest.  Please trim your response.
>
> Today's Topics:
>
>   1. Re: ERROR: c:\Snort\rules\app-detect.rules(33) Unknown
>      ClassType: web-application-attack (wkitty42 () windstream net)
>   2. Re: Hello Snort Team (wkitty42 () windstream net)
>   3. Re: Snort-users Digest, Vol 132, Issue 23 (Paul Trimby)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Sun, 21 May 2017 12:14:43 -0400
> From: wkitty42 () windstream net
> Subject: Re: [Snort-users] ERROR: c:\Snort\rules\app-detect.rules(33)
>       Unknown ClassType: web-application-attack
> To: snort-users () lists sourceforge net
> Message-ID: <48621e2e-9a9a-c807-6655-4ff5115d909f () windstream net>
> Content-Type: text/plain; charset=utf-8; format=flowed
>
> On 05/21/2017 06:58 AM, Dionne Queen wrote:
> > Hello,
> > I installed Snort via Windows and tried to its alerts.
> > I received the following Error msg:
> > ERROR: c:\Snort\rules\app-detect.rules(33) Unknown ClassType: web-application-attack
> >
> > Any advice on how to get rid of this?
>
> your classification.config file is out of date or at least doesn't contain that 
> classification type... here's mine which is a combination of the Talos and 
> Emerging Threats classifications... watch for wordwrap... every non-comment line 
> starts with "config"...
>
>
> ----->8 snip 8<-----
> # $Id$
> # The following includes information for prioritizing rules
> # 
>
>
> # Each classification includes a shortname, a description, and a default 
>
>
> # priority for that classification. 
>
>
> # 
>
>
> # This allows alerts to be classified and prioritized.  You can specify 
>
>
> # what priority each classification has.  Any rule can override the default 
>
>
> # priority for that rule. 
>
>
> # 
>
>
> # Here are a few example rules: 
>
>
> # 
>
>
> #   alert TCP any any -> any 80 (msg: "EXPLOIT ntpdx overflow"; 
>
>
> #       dsize: > 128; classtype:attempted-admin; priority:10; 
>
>
> # 
>
>
> #   alert TCP any any -> any 25 (msg:"SMTP expn root"; flags:A+; \ 
>
>
> #             content:"expn root"; nocase; classtype:attempted-recon;) 
>
>
> # 
>
>
> # The first rule will set its type to "attempted-admin" and override 
>
>
> # the default priority for that type to 10. 
>
>
> # 
>
>
> # The second rule set its type to "attempted-recon" and set its 
>
>
> # priority to the default for that type. 
>
>
> # 
>
>
>
> #
> # config classification:shortname,short description,priority
> #
>
> config classification: not-suspicious,Not Suspicious Traffic,3
> config classification: unknown,Unknown Traffic,3
> config classification: bad-unknown,Potentially Bad Traffic, 2
> config classification: attempted-recon,Attempted Information Leak,2
> config classification: successful-recon-limited,Information Leak,2
> config classification: successful-recon-largescale,Large Scale Information Leak,2
> config classification: attempted-dos,Attempted Denial of Service,2
> config classification: successful-dos,Denial of Service,2
> config classification: attempted-user,Attempted User Privilege Gain,1
> config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1
> config classification: successful-user,Successful User Privilege Gain,1
> config classification: attempted-admin,Attempted Administrator Privilege Gain,1
> config classification: successful-admin,Successful Administrator Privilege Gain,1
>
> # NEW CLASSIFICATIONS
> config classification: rpc-portmap-decode,Decode of an RPC Query,2
> config classification: shellcode-detect,Executable code was detected,1
> config classification: string-detect,A suspicious string was detected,3
> config classification: suspicious-filename-detect,A suspicious filename was 
> detected,2
> config classification: suspicious-login,An attempted login using a suspicious 
> username was detected,2
> config classification: system-call-detect,A system call was detected,2
> config classification: tcp-connection,A TCP connection was detected,4
> config classification: trojan-activity,A Network Trojan was detected, 1
> config classification: unusual-client-port-connection,A client was using an 
> unusual port,2
> config classification: network-scan,Detection of a Network Scan,3
> config classification: denial-of-service,Detection of a Denial of Service Attack,2
> config classification: non-standard-protocol,Detection of a non-standard 
> protocol or event,2
> config classification: protocol-command-decode,Generic Protocol Command Decode,3
> config classification: web-application-activity,access to a potentially 
> vulnerable web application,2
> config classification: web-application-attack,Web Application Attack,1
> config classification: misc-activity,Misc activity,3
> config classification: misc-attack,Misc Attack,2
> config classification: icmp-event,Generic ICMP event,3
> config classification: inappropriate-content,Inappropriate Content was Detected,1
> config classification: policy-violation,Potential Corporate Privacy Violation,1
> config classification: default-login-attempt,Attempt to login by a default 
> username and password,2
> config classification: sdf,Senstive Data,2
> config classification: file-format,Known malicious file or file based exploit,1
> config classification: malware-cnc,Known malware command and control traffic,1
> config classification: client-side-exploit,Known client side exploit attempt,1
> ----->8 snip 8<-----
>
>
> -- 
>  NOTE: No off-list assistance is given without prior approval.
>        *Please keep mailing list traffic on the list unless*
>        *a signed and pre-paid contract is in effect with us.*
>
>
>
> ------------------------------
>
> Message: 2
> Date: Sun, 21 May 2017 12:17:52 -0400
> From: wkitty42 () windstream net
> Subject: Re: [Snort-users] Hello Snort Team
> To: snort-users () lists sourceforge net
> Message-ID: <a5768484-c74a-3513-e662-7b123ccf1586 () windstream net>
> Content-Type: text/plain; charset=utf-8; format=flowed
>
> On 05/21/2017 09:49 AM, Paul Trimby wrote:
> > I've been successful installing snort on my Linux OS Mint version 17.2
> > but keep getting an ERROR message after running $ sudo snort
> > -c/etc/snort/snort.conf -T
> >
> > The output looks like this:
> [...]
> > +++++++++++++++++++++++++++++++++++++++++++++++++++
> > Initializing rule chains...
> > ERROR: /etc/snort/snort.conf(257) Unknown rule type: path.
> > Fatal Error, Quitting..
> > x@x /usr/local/bin $
> >
> > Would you be able to explain to me how I could fix this ERROR message
>
> please post your snort.conf's lines 250 through 260... apparently your line 257 
> is broken... possibly it is word wrapped from you editor when you edited the 
> file for your configuration...
>
>
> -- 
>  NOTE: No off-list assistance is given without prior approval.
>        *Please keep mailing list traffic on the list unless*
>        *a signed and pre-paid contract is in effect with us.*
>
>
>
> ------------------------------
>
> Message: 3
> Date: Sun, 21 May 2017 19:12:29 +0100
> From: Paul Trimby <paultrimby () gmx co uk>
> Subject: Re: [Snort-users] Snort-users Digest, Vol 132, Issue 23
> To: snort-users () lists sourceforge net
> Message-ID: <1495390349.4032.15.camel () gmx co uk>
> Content-Type: text/plain; charset="UTF-8"
>
>
>
> Hi?@Rmkml
>
> I think ive cracked it. ?Although ive updated my system to Linux mint
> 18.1, which has had a change of network interface name so when
> installing it was asking for eth0 when I have enp1s0 but seems to work
> OK. Read out is below:?
>
> Not sure what the WARNING SIGNS mean:
>
>
> x@x ~ $ ifconfig
> enp1s0????Link encap:Ethernet??HWaddr 40:8d:5c:0f:fe:66??
> ??????????inetaddr:192.168.0.5??Bcast:192.168.0.255??Mask:255.255.255.0
> ??????????inet6 addr: fe80::b5e0:f94d:e763:fd8f/64 Scope:Link
> ??????????UP BROADCAST RUNNING MULTICAST??MTU:1500??Metric:1
> ??????????RX packets:6096 errors:0 dropped:0 overruns:0 frame:0
> ??????????TX packets:5131 errors:0 dropped:0 overruns:0 carrier:0
> ??????????collisions:0 txqueuelen:1000?
> ??????????RX bytes:4325380 (4.3 MB)??TX bytes:762704 (762.7 KB)
>
> lo????????Link encap:Local Loopback??
> ??????????inet addr:127.0.0.1??Mask:255.0.0.0
> ??????????inet6 addr: ::1/128 Scope:Host
> ??????????UP LOOPBACK RUNNING??MTU:65536??Metric:1
> ??????????RX packets:717 errors:0 dropped:0 overruns:0 frame:0
> ??????????TX packets:717 errors:0 dropped:0 overruns:0 carrier:0
> ??????????collisions:0 txqueuelen:1?
> ??????????RX bytes:74360 (74.3 KB)??TX bytes:74360 (74.3 KB)
>
> ---------------------------------------------------------------------
>
>
> x@x /usr/local/bin $ sudo snort -c/etc/snort/snort.conf -T
> Running in Test mode
>
> ????????--== Initializing Snort ==--
> Initializing Output Plugins!
> Initializing Preprocessors!
> Initializing Plug-ins!
> Parsing Rules file "/etc/snort/snort.conf"
> PortVar 'HTTP_PORTS' defined :??[ 80:81 311 383 591 593 901 1220 1414
> 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000:7001
> 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118
> 8123 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091
> 9443 9999 11371 34443:34444 41080 50002 55555 ]
> PortVar 'SHELLCODE_PORTS' defined :??[ 0:79 81:65535 ]
> PortVar 'ORACLE_PORTS' defined :??[ 1024:65535 ]
> PortVar 'SSH_PORTS' defined :??[ 22 ]
> PortVar 'FTP_PORTS' defined :??[ 21 2100 3535 ]
> PortVar 'SIP_PORTS' defined :??[ 5060:5061 5600 ]
> PortVar 'FILE_DATA_PORTS' defined :??[ 80:81 110 143 311 383 591 593
> 901 1220 1414 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250
> 6988 7000:7001 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085
> 8088 8090 8118 8123 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060
> 9080 9090:9091 9443 9999 11371 34443:34444 41080 50002 55555 ]
> PortVar 'GTP_PORTS' defined :??[ 2123 2152 3386 ]
> Detection:
> ???Search-Method = AC-Full-Q
> ????Split Any/Any group = enabled
> ????Search-Method-Optimizations = enabled
> ????Maximum pattern length = 20
> Tagged Packet Limit: 256
> Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so...
> done
> Loading all dynamic detection libs from /usr/lib/snort_dynamicrules...
> WARNING: No dynamic libraries found in directory
> /usr/lib/snort_dynamicrules.
> ? Finished Loading all dynamic detection libs from
> /usr/lib/snort_dynamicrules
> Loading all dynamic preprocessor libs from
> /usr/lib/snort_dynamicpreprocessor/...
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_imap_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_dnp3_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_pop_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_gtp_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_modbus_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_sip_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_reputation_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... done
> ? Loading dynamic preprocessor library
> /usr/lib/snort_dynamicpreprocessor//libsf_sdf_preproc.so... done
> ? Finished Loading all dynamic preprocessor libs from
> /usr/lib/snort_dynamicpreprocessor/
> Log directory = /var/log/snort
> WARNING: ip4 normalizations disabled because not inline.
> WARNING: tcp normalizations disabled because not inline.
> WARNING: icmp4 normalizations disabled because not inline.
> WARNING: ip6 normalizations disabled because not inline.
> WARNING: icmp6 normalizations disabled because not inline.
> Frag3 global config:
> ????Max frags: 65536
> ????Fragment memory cap: 4194304 bytes
> Frag3 engine config:
> ????Bound Address: default
> ????Target-based policy: WINDOWS
> ????Fragment timeout: 180 seconds
> ????Fragment min_ttl:???1
> ????Fragment Anomalies: Alert
> ????Overlap Limit:?????10
> ????Min fragment Length:?????100
> ??????Max Expected Streams: 768
> Stream global config:
> ????Track TCP sessions: ACTIVE
> ????Max TCP sessions: 262144
> ????TCP cache pruning timeout: 30 seconds
> ????TCP cache nominal timeout: 3600 seconds
> ????Memcap (for reassembly packet storage): 8388608
> ????Track UDP sessions: ACTIVE
> ????Max UDP sessions: 131072
> ????UDP cache pruning timeout: 30 seconds
> ????UDP cache nominal timeout: 180 seconds
> ????Track ICMP sessions: INACTIVE
> ????Track IP sessions: INACTIVE
> ????Log info if session memory consumption exceeds 1048576
> ????Send up to 2 active responses
> ????Wait at least 5 seconds between responses
> ????Protocol Aware Flushing: ACTIVE
> ????????Maximum Flush Point: 16000
> Stream TCP Policy config:
> ????Bound Address: default
> ????Reassembly Policy: WINDOWS
> ????Timeout: 180 seconds
> ????Limit on TCP Overlaps: 10
> ????Maximum number of bytes to queue per session: 1048576
> ????Maximum number of segs to queue per session: 2621
> ????Options:
> ????????Require 3-Way Handshake: YES
> ????????3-Way Handshake Timeout: 180
> ????????Detect Anomalies: YES
> ????Reassembly Ports:
> ??????21 client (Footprint)?
> ??????22 client (Footprint)?
> ??????23 client (Footprint)?
> ??????25 client (Footprint)?
> ??????42 client (Footprint)?
> ??????53 client (Footprint)?
> ??????79 client (Footprint)?
> ??????80 client (Footprint) server (Footprint)
> ??????81 client (Footprint) server (Footprint)
> ??????109 client (Footprint)?
> ??????110 client (Footprint)?
> ??????111 client (Footprint)?
> ??????113 client (Footprint)?
> ??????119 client (Footprint)?
> ??????135 client (Footprint)?
> ??????136 client (Footprint)?
> ??????137 client (Footprint)?
> ??????139 client (Footprint)?
> ??????143 client (Footprint)?
> ??????161 client (Footprint)?
> ??????additional ports configured but not printed.
> Stream UDP Policy config:
> ????Timeout: 180 seconds
> HttpInspect Config:
> ????GLOBAL CONFIG
> ??????Detect Proxy Usage:???????NO
> ??????IIS Unicode Map Filename: /etc/snort/unicode.map
> ??????IIS Unicode Map Codepage: 1252
> ??????Memcap used for logging URI and Hostname: 150994944
> ??????Max Gzip Memory: 104857600
> ??????Max Gzip Sessions: 201649
> ??????Gzip Compress Depth: 65535
> ??????Gzip Decompress Depth: 65535
> ????DEFAULT SERVER CONFIG:
> ??????Server profile: All
> ??????Ports (PAF): 80 81 311 383 591 593 901 1220 1414 1741 1830 2301
> 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000 7001 7144 7145 7510
> 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123 8180 8181
> 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090 9091 9443 9999 11371
> 34443 34444 41080 50002 55555?
> ??????Server Flow Depth: 0
> ??????Client Flow Depth: 0
> ??????Max Chunk Length: 500000
> ??????Small Chunk Length Evasion: chunk size <= 10, threshold >= 5
> times
> ??????Max Header Field Length: 750
> ??????Max Number Header Fields: 100
> ??????Max Number of WhiteSpaces allowed with header folding: 200
> ??????Inspect Pipeline Requests: YES
> ??????URI Discovery Strict Mode: NO
> ??????Allow Proxy Usage: NO
> ??????Disable Alerting: NO
> ??????Oversize Dir Length: 500
> ??????Only inspect URI: NO
> ??????Normalize HTTP Headers: NO
> ??????Inspect HTTP Cookies: YES
> ??????Inspect HTTP Responses: YES
> ??????Extract Gzip from responses: YES
> ??????Decompress response files:???
> ??????Unlimited decompression of gzip data from responses: YES
> ??????Normalize Javascripts in HTTP Responses: YES
> ??????Max Number of WhiteSpaces allowed with Javascript Obfuscation in
> HTTP responses: 200
> ??????Normalize HTTP Cookies: NO
> ??????Enable XFF and True Client IP: NO
> ??????Log HTTP URI data: NO
> ??????Log HTTP Hostname data: NO
> ??????Extended ASCII code support in URI: NO
> ??????Ascii: YES alert: NO
> ??????Double Decoding: YES alert: NO
> ??????%U Encoding: YES alert: YES
> ??????Bare Byte: YES alert: NO
> ??????UTF 8: YES alert: NO
> ??????IIS Unicode: YES alert: NO
> ??????Multiple Slash: YES alert: NO
> ??????IIS Backslash: YES alert: NO
> ??????Directory Traversal: YES alert: NO
> ??????Web Root Traversal: YES alert: NO
> ??????Apache WhiteSpace: YES alert: NO
> ??????IIS Delimiter: YES alert: NO
> ??????IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
> ??????Non-RFC Compliant Characters: 0x00 0x01 0x02 0x03 0x04 0x05 0x06
> 0x07?
> ??????Whitespace Characters: 0x09 0x0b 0x0c 0x0d?
> rpc_decode arguments:
> ????Ports to decode RPC on: 111 32770 32771 32772 32773 32774 32775
> 32776 32777 32778 32779?
> ????alert_fragments: INACTIVE
> ????alert_large_fragments: INACTIVE
> ????alert_incomplete: INACTIVE
> ????alert_multiple_requests: INACTIVE
> FTPTelnet Config:
> ????GLOBAL CONFIG
> ??????Inspection Type: stateful
> ??????Check for Encrypted Traffic: YES alert: NO
> ??????Continue to check encrypted data: YES
> ????TELNET CONFIG:
> ??????Ports: 23?
> ??????Are You There Threshold: 20
> ??????Normalize: YES
> ??????Detect Anomalies: YES
> ????FTP CONFIG:
> ??????FTP Server: default
> ????????Ports (PAF): 21 2100 3535?
> ????????Check for Telnet Cmds: YES alert: YES
> ????????Ignore Telnet Cmd Operations: YES alert: YES
> ????????Ignore open data channels: NO
> ??????FTP Client: default
> ????????Check for Bounce Attacks: YES alert: YES
> ????????Check for Telnet Cmds: YES alert: YES
> ????????Ignore Telnet Cmd Operations: YES alert: YES
> ????????Max Response Length: 256
> SMTP Config:
> ????Ports: 25 465 587 691?
> ????Inspection Type: Stateful
> ????Normalize: ATRN AUTH BDAT DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN
> EVFY EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND
> STARTTLS SOML TICK TIME TURN TURNME VERB VRFY X-EXPS XADR XAUTH XCIR
> XEXCH50 XGEN XLICENSE X-LINK2STATE XQUE XSTA XTRN XUSR CHUNKING X-ADAT
> X-DRCP X-ERCP X-EXCH50?
> ????Ignore Data: No
> ????Ignore TLS Data: No
> ????Ignore SMTP Alerts: No
> ????Max Command Line Length: 512
> ????Max Specific Command Line Length:?
> ???????ATRN:255 AUTH:246 BDAT:255 DATA:246 DEBUG:255?
> ???????EHLO:500 EMAL:255 ESAM:255 ESND:255 ESOM:255?
> ???????ETRN:246 EVFY:255 EXPN:255 HELO:500 HELP:500?
> ???????IDENT:255 MAIL:260 NOOP:255 ONEX:246 QUEU:246?
> ???????QUIT:246 RCPT:300 RSET:246 SAML:246 SEND:246?
> ???????SIZE:255 STARTTLS:246 SOML:246 TICK:246 TIME:246?
> ???????TURN:246 TURNME:246 VERB:246 VRFY:255 X-EXPS:246?
> ???????XADR:246 XAUTH:246 XCIR:246 XEXCH50:246 XGEN:246?
> ???????XLICENSE:246 X-LINK2STATE:246 XQUE:246 XSTA:246 XTRN:246?
> ???????XUSR:246?
> ????Max Header Line Length: 1000
> ????Max Response Line Length: 512
> ????X-Link2State Alert: Yes
> ????Drop on X-Link2State Alert: No
> ????Alert on commands: None
> ????Alert on unknown commands: No
> ????SMTP Memcap: 838860
> ????MIME Max Mem: 838860
> ????Base64 Decoding: Enabled
> ????Base64 Decoding Depth: Unlimited
> ????Quoted-Printable Decoding: Enabled
> ????Quoted-Printable Decoding Depth: Unlimited
> ????Unix-to-Unix Decoding: Enabled
> ????Unix-to-Unix Decoding Depth: Unlimited
> ????Non-Encoded MIME attachment Extraction: Enabled
> ????Non-Encoded MIME attachment Extraction Depth: Unlimited
> ????Log Attachment filename: Enabled
> ????Log MAIL FROM Address: Enabled
> ????Log RCPT TO Addresses: Enabled
> ????Log Email Headers: Enabled
> ????Email Hdrs Log Depth: 1464
> SSH config:?
> ????Autodetection: ENABLED
> ????Challenge-Response Overflow Alert: ENABLED
> ????SSH1 CRC32 Alert: ENABLED
> ????Server Version String Overflow Alert: ENABLED
> ????Protocol Mismatch Alert: ENABLED
> ????Bad Message Direction Alert: DISABLED
> ????Bad Payload Size Alert: DISABLED
> ????Unrecognized Version Alert: DISABLED
> ????Max Encrypted Packets: 20??
> ????Max Server Version String Length: 100??
> ????MaxClientBytes: 19600 (Default)?
> ????Ports:
>       22
> DCE/RPC 2 Preprocessor Configuration
> ? Global Configuration
> ????DCE/RPC Defragmentation: Enabled
> ????Memcap: 102400 KB
> ????Events: co?
> ????SMB Fingerprint policy: Disabled
> ? Server Default Configuration
> ????Policy: WinXP
> ????Detect ports (PAF)
> ??????SMB: 139 445?
> ??????TCP: 135?
> ??????UDP: 135?
> ??????RPC over HTTP server: 593?
> ??????RPC over HTTP proxy: None
> ????Autodetect ports (PAF)
> ??????SMB: None
> ??????TCP: 1025-65535?
> ??????UDP: 1025-65535?
> ??????RPC over HTTP server: 1025-65535?
> ??????RPC over HTTP proxy: None
> ????Invalid SMB shares: C$ D$ ADMIN$?
> ????Maximum SMB command chaining: 3 commands
> ????SMB file inspection: Disabled
> DNS config:?
> ????DNS Client rdata txt Overflow Alert: ACTIVE
> ????Obsolete DNS RR Types Alert: INACTIVE
> ????Experimental DNS RR Types Alert: INACTIVE
> ????Ports: 53
> SSLPP config:
> ????Encrypted packets: not inspected
> ????Ports:
> ??????443??????465??????563??????636??????989
> ??????992??????993??????994??????995?????7801
> ?????7802?????7900?????7901?????7902?????7903
> ?????7904?????7905?????7906?????7907?????7908
> ?????7909?????7910?????7911?????7912?????7913
> ?????7914?????7915?????7916?????7917?????7918
> ?????7919?????7920
> ????Server side data is trusted
> ????Maximum SSL Heartbeat length: 0
> Sensitive Data preprocessor config:?
> ????Global Alert Threshold: 25
> ????Masked Output: DISABLED
> SIP config:?
> ????Max number of sessions: 40000??
> ????Max number of dialogs in a session: 4 (Default)?
> ????Status: ENABLED
> ????Ignore media channel: DISABLED
> ????Max URI length: 512??
> ????Max Call ID length: 80??
> ????Max Request name length: 20 (Default)?
> ????Max From length: 256 (Default)?
> ????Max To length: 256 (Default)?
> ????Max Via length: 1024 (Default)?
> ????Max Contact length: 512??
> ????Max Content length: 2048??
> ????Ports:
>       5060    5061    5600
> ????Methods:
>       ??invite cancel ack bye register options refer subscribe update
> join info message notify benotify do qauth sprack publish service
> unsubscribe prack
> IMAP Config:
> ????Ports: 143?
> ????IMAP Memcap: 838860
> ????MIME Max Mem: 838860
> ????Base64 Decoding: Enabled
> ????Base64 Decoding Depth: Unlimited
> ????Quoted-Printable Decoding: Enabled
> ????Quoted-Printable Decoding Depth: Unlimited
> ????Unix-to-Unix Decoding: Enabled
> ????Unix-to-Unix Decoding Depth: Unlimited
> ????Non-Encoded MIME attachment Extraction: Enabled
> ????Non-Encoded MIME attachment Extraction Depth: Unlimited
> POP Config:
> ????Ports: 110?
> ????POP Memcap: 838860
> ????MIME Max Mem: 838860
> ????Base64 Decoding: Enabled
> ????Base64 Decoding Depth: Unlimited
> ????Quoted-Printable Decoding: Enabled
> ????Quoted-Printable Decoding Depth: Unlimited
> ????Unix-to-Unix Decoding: Enabled
> ????Unix-to-Unix Decoding Depth: Unlimited
> ????Non-Encoded MIME attachment Extraction: Enabled
> ????Non-Encoded MIME attachment Extraction Depth: Unlimited
> Modbus config:?
> ????Ports:
>       502
> DNP3 config:?
> ????Memcap: 262144
> ????Check Link-Layer CRCs: ENABLED
> ????Ports:
>       20000
>
> +++++++++++++++++++++++++++++++++++++++++++++++++++
> Initializing rule chains...
> WARNING: /etc/snort/rules/chat.rules(33) threshold (in rule) is
> deprecated; use detection_filter instead.
>
> WARNING: /etc/snort/rules/community-sql-injection.rules(6) GID 1 SID
> 100000106 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-sql-injection.rules(7) GID 1 SID
> 100000107 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-sql-injection.rules(8) GID 1 SID
> 100000108 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-sql-injection.rules(9) GID 1 SID
> 100000109 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-sql-injection.rules(11) GID 1 SID
> 100000192 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-sql-injection.rules(12) GID 1 SID
> 100000193 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-sql-injection.rules(13) GID 1 SID
> 100000194 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-sql-injection.rules(14) GID 1 SID
> 100000690 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-sql-injection.rules(15) GID 1 SID
> 100000691 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-client.rules(6) GID 1 SID
> 100000118 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-client.rules(7) GID 1 SID
> 100000119 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-client.rules(9) GID 1 SID
> 100000228 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-client.rules(14) GID 1 SID
> 100000284 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-client.rules(16) GID 1 SID
> 100000447 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-client.rules(18) GID 1 SID
> 100000692 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-client.rules(20) GID 1 SID
> 100000693 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-client.rules(23) GID 1 SID
> 100000864 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-iis.rules(7) GID 1 SID
> 100000138 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-iis.rules(8) GID 1 SID
> 100000139 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-iis.rules(9) GID 1 SID
> 100000173 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-iis.rules(10) GID 1 SID
> 100000174 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(6) GID 1 SID
> 100000121 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(7) GID 1 SID
> 100000122 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(8) GID 1 SID
> 100000129 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(9) GID 1 SID
> 100000130 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(10) GID 1 SID
> 100000131 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(12) GID 1 SID
> 100000132 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(13) GID 1 SID
> 100000133 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(14) GID 1 SID
> 100000140 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(15) GID 1 SID
> 100000141 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(16) GID 1 SID
> 100000142 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(17) GID 1 SID
> 100000143 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(18) GID 1 SID
> 100000144 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(19) GID 1 SID
> 100000145 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(20) GID 1 SID
> 100000146 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(22) GID 1 SID
> 100000148 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(23) GID 1 SID
> 100000149 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(24) GID 1 SID
> 100000150 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(25) GID 1 SID
> 100000177 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(26) GID 1 SID
> 100000178 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(27) GID 1 SID
> 100000179 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(28) GID 1 SID
> 100000184 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(29) GID 1 SID
> 100000185 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(30) GID 1 SID
> 100000200 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(31) GID 1 SID
> 100000209 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(33) GID 1 SID
> 100000216 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(34) GID 1 SID
> 100000217 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(35) GID 1 SID
> 100000225 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(38) GID 1 SID
> 100000237 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(39) GID 1 SID
> 100000302 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(40) GID 1 SID
> 100000303 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(42) GID 1 SID
> 100000313 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(43) GID 1 SID
> 100000314 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(49) GID 1 SID
> 100000317 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(50) GID 1 SID
> 100000318 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(51) GID 1 SID
> 100000319 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(52) GID 1 SID
> 100000320 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(53) GID 1 SID
> 100000321 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(54) GID 1 SID
> 100000322 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(55) GID 1 SID
> 100000323 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(56) GID 1 SID
> 100000324 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(57) GID 1 SID
> 100000325 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(58) GID 1 SID
> 100000326 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(59) GID 1 SID
> 100000327 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(60) GID 1 SID
> 100000328 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(61) GID 1 SID
> 100000329 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(62) GID 1 SID
> 100000330 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(63) GID 1 SID
> 100000331 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(64) GID 1 SID
> 100000332 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(65) GID 1 SID
> 100000333 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(66) GID 1 SID
> 100000334 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(67) GID 1 SID
> 100000335 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(68) GID 1 SID
> 100000336 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(69) GID 1 SID
> 100000337 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(70) GID 1 SID
> 100000338 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(71) GID 1 SID
> 100000339 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(72) GID 1 SID
> 100000340 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(73) GID 1 SID
> 100000341 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(74) GID 1 SID
> 100000342 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(75) GID 1 SID
> 100000343 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(76) GID 1 SID
> 100000344 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(77) GID 1 SID
> 100000345 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(78) GID 1 SID
> 100000346 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(79) GID 1 SID
> 100000347 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(80) GID 1 SID
> 100000348 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(81) GID 1 SID
> 100000349 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(82) GID 1 SID
> 100000350 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(83) GID 1 SID
> 100000351 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(84) GID 1 SID
> 100000352 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(85) GID 1 SID
> 100000353 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(86) GID 1 SID
> 100000354 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(87) GID 1 SID
> 100000355 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(88) GID 1 SID
> 100000356 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(89) GID 1 SID
> 100000357 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(90) GID 1 SID
> 100000358 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(91) GID 1 SID
> 100000359 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(92) GID 1 SID
> 100000360 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(93) GID 1 SID
> 100000361 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(94) GID 1 SID
> 100000362 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(95) GID 1 SID
> 100000363 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(96) GID 1 SID
> 100000364 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(97) GID 1 SID
> 100000365 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(98) GID 1 SID
> 100000366 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(99) GID 1 SID
> 100000367 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(100) GID 1 SID
> 100000368 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(101) GID 1 SID
> 100000369 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(102) GID 1 SID
> 100000370 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(103) GID 1 SID
> 100000371 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(104) GID 1 SID
> 100000372 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(105) GID 1 SID
> 100000373 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(106) GID 1 SID
> 100000374 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(107) GID 1 SID
> 100000375 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(108) GID 1 SID
> 100000376 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(109) GID 1 SID
> 100000377 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(110) GID 1 SID
> 100000378 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(111) GID 1 SID
> 100000379 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(112) GID 1 SID
> 100000380 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(113) GID 1 SID
> 100000382 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(114) GID 1 SID
> 100000383 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(115) GID 1 SID
> 100000384 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(116) GID 1 SID
> 100000385 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(117) GID 1 SID
> 100000386 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(119) GID 1 SID
> 100000387 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(120) GID 1 SID
> 100000388 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(121) GID 1 SID
> 100000389 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(122) GID 1 SID
> 100000390 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(123) GID 1 SID
> 100000391 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(124) GID 1 SID
> 100000392 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(125) GID 1 SID
> 100000393 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(126) GID 1 SID
> 100000394 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(127) GID 1 SID
> 100000395 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(128) GID 1 SID
> 100000396 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(129) GID 1 SID
> 100000397 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(130) GID 1 SID
> 100000398 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(131) GID 1 SID
> 100000399 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(132) GID 1 SID
> 100000400 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(133) GID 1 SID
> 100000401 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(134) GID 1 SID
> 100000402 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(135) GID 1 SID
> 100000403 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(136) GID 1 SID
> 100000404 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(137) GID 1 SID
> 100000405 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(138) GID 1 SID
> 100000406 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(139) GID 1 SID
> 100000407 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(140) GID 1 SID
> 100000408 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(141) GID 1 SID
> 100000409 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(142) GID 1 SID
> 100000410 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(143) GID 1 SID
> 100000411 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(144) GID 1 SID
> 100000412 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(145) GID 1 SID
> 100000413 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(146) GID 1 SID
> 100000414 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(147) GID 1 SID
> 100000415 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(148) GID 1 SID
> 100000416 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(149) GID 1 SID
> 100000417 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(150) GID 1 SID
> 100000418 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(151) GID 1 SID
> 100000419 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(152) GID 1 SID
> 100000420 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(153) GID 1 SID
> 100000421 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(154) GID 1 SID
> 100000422 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(155) GID 1 SID
> 100000423 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(156) GID 1 SID
> 100000424 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(157) GID 1 SID
> 100000425 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(158) GID 1 SID
> 100000426 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(161) GID 1 SID
> 100000427 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(162) GID 1 SID
> 100000428 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(163) GID 1 SID
> 100000429 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(166) GID 1 SID
> 100000430 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(167) GID 1 SID
> 100000431 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(168) GID 1 SID
> 100000432 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(169) GID 1 SID
> 100000433 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(170) GID 1 SID
> 100000434 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(171) GID 1 SID
> 100000435 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(172) GID 1 SID
> 100000436 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(173) GID 1 SID
> 100000437 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(174) GID 1 SID
> 100000438 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(175) GID 1 SID
> 100000439 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(176) GID 1 SID
> 100000440 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(177) GID 1 SID
> 100000441 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(178) GID 1 SID
> 100000442 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(179) GID 1 SID
> 100000443 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(180) GID 1 SID
> 100000444 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(181) GID 1 SID
> 100000448 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(182) GID 1 SID
> 100000449 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(183) GID 1 SID
> 100000450 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(184) GID 1 SID
> 100000451 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(185) GID 1 SID
> 100000452 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(186) GID 1 SID
> 100000453 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(187) GID 1 SID
> 100000454 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(188) GID 1 SID
> 100000455 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(189) GID 1 SID
> 100000456 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(190) GID 1 SID
> 100000457 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(191) GID 1 SID
> 100000458 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(192) GID 1 SID
> 100000459 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(193) GID 1 SID
> 100000460 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(194) GID 1 SID
> 100000461 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(195) GID 1 SID
> 100000462 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(196) GID 1 SID
> 100000694 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(197) GID 1 SID
> 100000695 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(198) GID 1 SID
> 100000696 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(199) GID 1 SID
> 100000697 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(200) GID 1 SID
> 100000698 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(201) GID 1 SID
> 100000699 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(202) GID 1 SID
> 100000700 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(203) GID 1 SID
> 100000701 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(204) GID 1 SID
> 100000702 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(207) GID 1 SID
> 100000890 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(208) GID 1 SID
> 100000891 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(211) GID 1 SID
> 100000895 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(212) GID 1 SID
> 100000896 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(213) GID 1 SID
> 100000897 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(214) GID 1 SID
> 100000898 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-misc.rules(215) GID 1 SID
> 100000899 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(6) GID 1 SID
> 100000151 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(7) GID 1 SID
> 100000186 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(8) GID 1 SID
> 100000187 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(9) GID 1 SID
> 100000188 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(10) GID 1 SID
> 100000195 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(11) GID 1 SID
> 100000201 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(12) GID 1 SID
> 100000202 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(13) GID 1 SID
> 100000203 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(14) GID 1 SID
> 100000204 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(15) GID 1 SID
> 100000205 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(16) GID 1 SID
> 100000206 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(17) GID 1 SID
> 100000211 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(18) GID 1 SID
> 100000212 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(19) GID 1 SID
> 100000213 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(20) GID 1 SID
> 100000214 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(21) GID 1 SID
> 100000218 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(22) GID 1 SID
> 100000220 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(23) GID 1 SID
> 100000221 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(24) GID 1 SID
> 100000285 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(25) GID 1 SID
> 100000286 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(26) GID 1 SID
> 100000287 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(27) GID 1 SID
> 100000288 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(28) GID 1 SID
> 100000289 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(29) GID 1 SID
> 100000290 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(30) GID 1 SID
> 100000291 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(31) GID 1 SID
> 100000292 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(32) GID 1 SID
> 100000293 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(33) GID 1 SID
> 100000294 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(34) GID 1 SID
> 100000295 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(35) GID 1 SID
> 100000296 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(36) GID 1 SID
> 100000297 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(37) GID 1 SID
> 100000298 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(38) GID 1 SID
> 100000299 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(39) GID 1 SID
> 100000300 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(40) GID 1 SID
> 100000304 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(41) GID 1 SID
> 100000305 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(42) GID 1 SID
> 100000306 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(43) GID 1 SID
> 100000307 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(44) GID 1 SID
> 100000308 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(45) GID 1 SID
> 100000309 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(46) GID 1 SID
> 100000445 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(48) GID 1 SID
> 100000463 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(49) GID 1 SID
> 100000464 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(50) GID 1 SID
> 100000465 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(51) GID 1 SID
> 100000466 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(52) GID 1 SID
> 100000467 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(53) GID 1 SID
> 100000468 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(54) GID 1 SID
> 100000469 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(55) GID 1 SID
> 100000470 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(56) GID 1 SID
> 100000471 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(57) GID 1 SID
> 100000472 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(58) GID 1 SID
> 100000473 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(59) GID 1 SID
> 100000474 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(60) GID 1 SID
> 100000475 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(61) GID 1 SID
> 100000476 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(62) GID 1 SID
> 100000477 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(63) GID 1 SID
> 100000478 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(64) GID 1 SID
> 100000479 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(65) GID 1 SID
> 100000480 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(66) GID 1 SID
> 100000481 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(67) GID 1 SID
> 100000482 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(68) GID 1 SID
> 100000483 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(69) GID 1 SID
> 100000484 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(70) GID 1 SID
> 100000485 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(71) GID 1 SID
> 100000486 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(72) GID 1 SID
> 100000487 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(73) GID 1 SID
> 100000488 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(74) GID 1 SID
> 100000489 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(75) GID 1 SID
> 100000490 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(76) GID 1 SID
> 100000491 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(77) GID 1 SID
> 100000492 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(78) GID 1 SID
> 100000493 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(79) GID 1 SID
> 100000494 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(80) GID 1 SID
> 100000495 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(81) GID 1 SID
> 100000496 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(82) GID 1 SID
> 100000497 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(83) GID 1 SID
> 100000498 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(84) GID 1 SID
> 100000499 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(85) GID 1 SID
> 100000500 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(86) GID 1 SID
> 100000501 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(87) GID 1 SID
> 100000502 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(88) GID 1 SID
> 100000503 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(89) GID 1 SID
> 100000504 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(90) GID 1 SID
> 100000505 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(91) GID 1 SID
> 100000506 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(92) GID 1 SID
> 100000507 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(93) GID 1 SID
> 100000508 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(94) GID 1 SID
> 100000509 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(95) GID 1 SID
> 100000510 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(96) GID 1 SID
> 100000511 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(97) GID 1 SID
> 100000512 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(98) GID 1 SID
> 100000513 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(99) GID 1 SID
> 100000514 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(100) GID 1 SID
> 100000515 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(101) GID 1 SID
> 100000516 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(102) GID 1 SID
> 100000517 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(103) GID 1 SID
> 100000518 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(104) GID 1 SID
> 100000519 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(105) GID 1 SID
> 100000520 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(106) GID 1 SID
> 100000521 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(107) GID 1 SID
> 100000522 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(108) GID 1 SID
> 100000523 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(109) GID 1 SID
> 100000524 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(110) GID 1 SID
> 100000525 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(111) GID 1 SID
> 100000526 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(112) GID 1 SID
> 100000527 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(113) GID 1 SID
> 100000528 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(114) GID 1 SID
> 100000529 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(115) GID 1 SID
> 100000530 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(116) GID 1 SID
> 100000531 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(117) GID 1 SID
> 100000532 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(118) GID 1 SID
> 100000533 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(119) GID 1 SID
> 100000534 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(120) GID 1 SID
> 100000535 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(121) GID 1 SID
> 100000536 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(122) GID 1 SID
> 100000537 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(123) GID 1 SID
> 100000538 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(124) GID 1 SID
> 100000539 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(125) GID 1 SID
> 100000540 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(126) GID 1 SID
> 100000541 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(127) GID 1 SID
> 100000542 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(128) GID 1 SID
> 100000543 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(129) GID 1 SID
> 100000544 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(130) GID 1 SID
> 100000545 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(131) GID 1 SID
> 100000546 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(132) GID 1 SID
> 100000547 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(133) GID 1 SID
> 100000548 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(134) GID 1 SID
> 100000549 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(135) GID 1 SID
> 100000550 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(136) GID 1 SID
> 100000551 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(137) GID 1 SID
> 100000552 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(138) GID 1 SID
> 100000553 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(139) GID 1 SID
> 100000554 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(140) GID 1 SID
> 100000555 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(141) GID 1 SID
> 100000556 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(142) GID 1 SID
> 100000557 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(143) GID 1 SID
> 100000558 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(144) GID 1 SID
> 100000559 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(145) GID 1 SID
> 100000560 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(146) GID 1 SID
> 100000561 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(147) GID 1 SID
> 100000562 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(148) GID 1 SID
> 100000563 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(149) GID 1 SID
> 100000564 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(150) GID 1 SID
> 100000565 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(151) GID 1 SID
> 100000566 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(152) GID 1 SID
> 100000567 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(153) GID 1 SID
> 100000568 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(154) GID 1 SID
> 100000569 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(155) GID 1 SID
> 100000570 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(156) GID 1 SID
> 100000571 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(157) GID 1 SID
> 100000572 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(158) GID 1 SID
> 100000573 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(159) GID 1 SID
> 100000574 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(160) GID 1 SID
> 100000575 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(161) GID 1 SID
> 100000576 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(162) GID 1 SID
> 100000577 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(163) GID 1 SID
> 100000578 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(164) GID 1 SID
> 100000579 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(165) GID 1 SID
> 100000580 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(166) GID 1 SID
> 100000581 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(167) GID 1 SID
> 100000582 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(168) GID 1 SID
> 100000583 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(169) GID 1 SID
> 100000584 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(170) GID 1 SID
> 100000585 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(171) GID 1 SID
> 100000586 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(172) GID 1 SID
> 100000587 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(173) GID 1 SID
> 100000588 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(174) GID 1 SID
> 100000589 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(175) GID 1 SID
> 100000590 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(176) GID 1 SID
> 100000591 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(177) GID 1 SID
> 100000592 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(178) GID 1 SID
> 100000593 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(179) GID 1 SID
> 100000594 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(180) GID 1 SID
> 100000595 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(181) GID 1 SID
> 100000596 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(182) GID 1 SID
> 100000597 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(183) GID 1 SID
> 100000598 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(184) GID 1 SID
> 100000599 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(185) GID 1 SID
> 100000600 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(186) GID 1 SID
> 100000601 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(187) GID 1 SID
> 100000602 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(188) GID 1 SID
> 100000603 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(189) GID 1 SID
> 100000604 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(190) GID 1 SID
> 100000605 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(191) GID 1 SID
> 100000606 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(192) GID 1 SID
> 100000607 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(193) GID 1 SID
> 100000608 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(194) GID 1 SID
> 100000609 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(195) GID 1 SID
> 100000610 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(196) GID 1 SID
> 100000611 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(197) GID 1 SID
> 100000612 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(198) GID 1 SID
> 100000613 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(199) GID 1 SID
> 100000614 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(200) GID 1 SID
> 100000615 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(201) GID 1 SID
> 100000616 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(202) GID 1 SID
> 100000617 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(203) GID 1 SID
> 100000618 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(204) GID 1 SID
> 100000619 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(205) GID 1 SID
> 100000620 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(206) GID 1 SID
> 100000621 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(207) GID 1 SID
> 100000622 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(208) GID 1 SID
> 100000623 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(209) GID 1 SID
> 100000624 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(210) GID 1 SID
> 100000625 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(211) GID 1 SID
> 100000626 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(212) GID 1 SID
> 100000627 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(213) GID 1 SID
> 100000628 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(214) GID 1 SID
> 100000629 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(215) GID 1 SID
> 100000630 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(216) GID 1 SID
> 100000631 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(217) GID 1 SID
> 100000632 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(218) GID 1 SID
> 100000633 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(219) GID 1 SID
> 100000634 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(220) GID 1 SID
> 100000635 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(221) GID 1 SID
> 100000636 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(222) GID 1 SID
> 100000637 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(223) GID 1 SID
> 100000638 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(224) GID 1 SID
> 100000639 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(225) GID 1 SID
> 100000640 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(226) GID 1 SID
> 100000641 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(227) GID 1 SID
> 100000642 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(228) GID 1 SID
> 100000643 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(229) GID 1 SID
> 100000644 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(230) GID 1 SID
> 100000645 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(231) GID 1 SID
> 100000646 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(232) GID 1 SID
> 100000647 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(233) GID 1 SID
> 100000648 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(234) GID 1 SID
> 100000649 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(235) GID 1 SID
> 100000650 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(236) GID 1 SID
> 100000651 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(237) GID 1 SID
> 100000652 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(238) GID 1 SID
> 100000653 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(239) GID 1 SID
> 100000654 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(240) GID 1 SID
> 100000655 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(241) GID 1 SID
> 100000656 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(242) GID 1 SID
> 100000657 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(243) GID 1 SID
> 100000658 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(244) GID 1 SID
> 100000659 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(245) GID 1 SID
> 100000660 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(246) GID 1 SID
> 100000661 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(247) GID 1 SID
> 100000662 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(248) GID 1 SID
> 100000663 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(249) GID 1 SID
> 100000664 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(250) GID 1 SID
> 100000665 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(251) GID 1 SID
> 100000666 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(252) GID 1 SID
> 100000667 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(253) GID 1 SID
> 100000668 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(254) GID 1 SID
> 100000669 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(255) GID 1 SID
> 100000670 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(256) GID 1 SID
> 100000671 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(257) GID 1 SID
> 100000672 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(258) GID 1 SID
> 100000673 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(259) GID 1 SID
> 100000674 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(260) GID 1 SID
> 100000675 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(261) GID 1 SID
> 100000676 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(262) GID 1 SID
> 100000677 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(263) GID 1 SID
> 100000678 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(264) GID 1 SID
> 100000679 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(265) GID 1 SID
> 100000680 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(266) GID 1 SID
> 100000681 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(267) GID 1 SID
> 100000682 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(268) GID 1 SID
> 100000683 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(270) GID 1 SID
> 100000703 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(271) GID 1 SID
> 100000704 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(272) GID 1 SID
> 100000705 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(273) GID 1 SID
> 100000706 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(274) GID 1 SID
> 100000707 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(275) GID 1 SID
> 100000708 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(276) GID 1 SID
> 100000709 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(277) GID 1 SID
> 100000710 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(278) GID 1 SID
> 100000711 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(279) GID 1 SID
> 100000712 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(280) GID 1 SID
> 100000713 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(281) GID 1 SID
> 100000714 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(282) GID 1 SID
> 100000715 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(283) GID 1 SID
> 100000716 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(284) GID 1 SID
> 100000717 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(285) GID 1 SID
> 100000718 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(286) GID 1 SID
> 100000719 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(287) GID 1 SID
> 100000720 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(288) GID 1 SID
> 100000721 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(289) GID 1 SID
> 100000722 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(290) GID 1 SID
> 100000723 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(291) GID 1 SID
> 100000724 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(292) GID 1 SID
> 100000725 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(293) GID 1 SID
> 100000726 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(294) GID 1 SID
> 100000727 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(295) GID 1 SID
> 100000728 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(296) GID 1 SID
> 100000729 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(297) GID 1 SID
> 100000730 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(298) GID 1 SID
> 100000731 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(299) GID 1 SID
> 100000732 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(300) GID 1 SID
> 100000733 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(301) GID 1 SID
> 100000734 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(302) GID 1 SID
> 100000735 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(303) GID 1 SID
> 100000736 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(304) GID 1 SID
> 100000737 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(305) GID 1 SID
> 100000738 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(306) GID 1 SID
> 100000739 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(307) GID 1 SID
> 100000740 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(308) GID 1 SID
> 100000741 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(309) GID 1 SID
> 100000742 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(310) GID 1 SID
> 100000743 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(311) GID 1 SID
> 100000744 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(312) GID 1 SID
> 100000745 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(313) GID 1 SID
> 100000746 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(314) GID 1 SID
> 100000747 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(315) GID 1 SID
> 100000748 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(316) GID 1 SID
> 100000749 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(317) GID 1 SID
> 100000750 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(318) GID 1 SID
> 100000751 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(319) GID 1 SID
> 100000752 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(320) GID 1 SID
> 100000753 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(321) GID 1 SID
> 100000754 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(322) GID 1 SID
> 100000755 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(323) GID 1 SID
> 100000756 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(324) GID 1 SID
> 100000757 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(325) GID 1 SID
> 100000758 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(326) GID 1 SID
> 100000759 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(327) GID 1 SID
> 100000760 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(328) GID 1 SID
> 100000761 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(329) GID 1 SID
> 100000762 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(330) GID 1 SID
> 100000763 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(331) GID 1 SID
> 100000764 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(332) GID 1 SID
> 100000765 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(333) GID 1 SID
> 100000766 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(334) GID 1 SID
> 100000767 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(335) GID 1 SID
> 100000768 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(336) GID 1 SID
> 100000769 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(337) GID 1 SID
> 100000770 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(338) GID 1 SID
> 100000771 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(339) GID 1 SID
> 100000772 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(340) GID 1 SID
> 100000773 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(341) GID 1 SID
> 100000774 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(342) GID 1 SID
> 100000775 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(343) GID 1 SID
> 100000776 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(344) GID 1 SID
> 100000777 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(345) GID 1 SID
> 100000778 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(346) GID 1 SID
> 100000779 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(347) GID 1 SID
> 100000780 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(348) GID 1 SID
> 100000781 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(349) GID 1 SID
> 100000782 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(350) GID 1 SID
> 100000783 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(351) GID 1 SID
> 100000784 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(352) GID 1 SID
> 100000785 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(353) GID 1 SID
> 100000786 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(354) GID 1 SID
> 100000787 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(355) GID 1 SID
> 100000788 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(356) GID 1 SID
> 100000789 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(357) GID 1 SID
> 100000790 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(358) GID 1 SID
> 100000791 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(359) GID 1 SID
> 100000792 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(360) GID 1 SID
> 100000793 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(361) GID 1 SID
> 100000794 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(362) GID 1 SID
> 100000795 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(363) GID 1 SID
> 100000796 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(364) GID 1 SID
> 100000797 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(365) GID 1 SID
> 100000798 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(366) GID 1 SID
> 100000799 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(367) GID 1 SID
> 100000800 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(368) GID 1 SID
> 100000801 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(369) GID 1 SID
> 100000802 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(370) GID 1 SID
> 100000803 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(371) GID 1 SID
> 100000804 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(372) GID 1 SID
> 100000805 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(373) GID 1 SID
> 100000806 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(374) GID 1 SID
> 100000807 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(375) GID 1 SID
> 100000808 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(376) GID 1 SID
> 100000809 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(377) GID 1 SID
> 100000810 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(378) GID 1 SID
> 100000811 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(379) GID 1 SID
> 100000812 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(380) GID 1 SID
> 100000813 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(381) GID 1 SID
> 100000814 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(382) GID 1 SID
> 100000815 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(383) GID 1 SID
> 100000816 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(384) GID 1 SID
> 100000817 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(385) GID 1 SID
> 100000818 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(386) GID 1 SID
> 100000820 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(387) GID 1 SID
> 100000821 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(388) GID 1 SID
> 100000822 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(389) GID 1 SID
> 100000823 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(390) GID 1 SID
> 100000824 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(391) GID 1 SID
> 100000825 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(392) GID 1 SID
> 100000826 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(393) GID 1 SID
> 100000827 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(394) GID 1 SID
> 100000828 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(395) GID 1 SID
> 100000829 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(396) GID 1 SID
> 100000830 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(397) GID 1 SID
> 100000831 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(398) GID 1 SID
> 100000832 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(399) GID 1 SID
> 100000833 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(400) GID 1 SID
> 100000834 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(401) GID 1 SID
> 100000835 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(402) GID 1 SID
> 100000836 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(403) GID 1 SID
> 100000837 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(404) GID 1 SID
> 100000838 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(405) GID 1 SID
> 100000839 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(406) GID 1 SID
> 100000840 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(407) GID 1 SID
> 100000841 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(408) GID 1 SID
> 100000842 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(409) GID 1 SID
> 100000843 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(410) GID 1 SID
> 100000844 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(411) GID 1 SID
> 100000845 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(412) GID 1 SID
> 100000846 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(413) GID 1 SID
> 100000847 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(414) GID 1 SID
> 100000849 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(415) GID 1 SID
> 100000850 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(416) GID 1 SID
> 100000851 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(417) GID 1 SID
> 100000852 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(418) GID 1 SID
> 100000853 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(419) GID 1 SID
> 100000854 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(420) GID 1 SID
> 100000855 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(421) GID 1 SID
> 100000856 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(422) GID 1 SID
> 100000857 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(423) GID 1 SID
> 100000858 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(424) GID 1 SID
> 100000859 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(425) GID 1 SID
> 100000860 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(426) GID 1 SID
> 100000861 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(427) GID 1 SID
> 100000862 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(428) GID 1 SID
> 100000863 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(431) GID 1 SID
> 100000865 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(432) GID 1 SID
> 100000866 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(433) GID 1 SID
> 100000867 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(434) GID 1 SID
> 100000868 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(435) GID 1 SID
> 100000869 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(436) GID 1 SID
> 100000870 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(437) GID 1 SID
> 100000871 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(438) GID 1 SID
> 100000872 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(439) GID 1 SID
> 100000873 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(441) GID 1 SID
> 100000882 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(443) GID 1 SID
> 100000883 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(444) GID 1 SID
> 100000884 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(445) GID 1 SID
> 100000885 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(446) GID 1 SID
> 100000886 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(447) GID 1 SID
> 100000887 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(448) GID 1 SID
> 100000888 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(449) GID 1 SID
> 100000889 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(450) GID 1 SID
> 100000906 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(451) GID 1 SID
> 100000907 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(452) GID 1 SID
> 100000908 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(453) GID 1 SID
> 100000909 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(454) GID 1 SID
> 100000910 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(455) GID 1 SID
> 100000911 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(456) GID 1 SID
> 100000912 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(457) GID 1 SID
> 100000913 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(458) GID 1 SID
> 100000914 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(459) GID 1 SID
> 100000915 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(460) GID 1 SID
> 100000916 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(461) GID 1 SID
> 100000917 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(462) GID 1 SID
> 100000918 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(463) GID 1 SID
> 100000919 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(464) GID 1 SID
> 100000920 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(465) GID 1 SID
> 100000921 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(466) GID 1 SID
> 100000922 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(467) GID 1 SID
> 100000925 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(468) GID 1 SID
> 100000926 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(469) GID 1 SID
> 100000929 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(470) GID 1 SID
> 100000930 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(471) GID 1 SID
> 100000931 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(472) GID 1 SID
> 100000932 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(473) GID 1 SID
> 100000933 in rule duplicates previous rule. Ignoring old rule.
>
> WARNING: /etc/snort/rules/community-web-php.rules(474) GID 1 SID
> 100000934 in rule duplicates previous rule. Ignoring old rule.
>
> 4150 Snort rules read
> ????3476 detection rules
> ????0 decoder rules
> ????0 preprocessor rules
> 3476 Option Chains linked into 278 Chain Headers
> 0 Dynamic rules
> +++++++++++++++++++++++++++++++++++++++++++++++++++
>
> +-------------------[Rule Port Counts]---------------------------------
> ------
> |?????????????tcp?????udp????icmp??????ip
> |?????src?????151??????18???????0???????0
> |?????dst????3306?????126???????0???????0
> |?????any?????383??????48?????145??????22
> |??????nc??????27???????8??????94??????20
> |?????s+d??????12???????5???????0???????0
> +--------------------------------------------------------------------
> --------
>
> +-----------------------[detection-filter-config]--------------------
> ----------
> | memory-cap : 1048576 bytes
> +-----------------------[detection-filter-rules]-----------------------
> --------
> | none
> ---------------------------------------------------------------------
> ----------
>
> +-----------------------[rate-filter-config]---------------------------
> --------
> | memory-cap : 1048576 bytes
> +-----------------------[rate-filter-rules]--------------------------
> ----------
> | none
> ---------------------------------------------------------------------
> ----------
>
> +-----------------------[event-filter-config]------------------------
> ----------
> | memory-cap : 1048576 bytes
> +-----------------------[event-filter-global]------------------------
> ----------
> | none
> +-----------------------[event-filter-local]---------------------------
> --------
> | gen-id=1??????sig-id=3152???????type=Threshold tracking=src
> count=5???seconds=2??
> | gen-id=1??????sig-id=2523???????type=Both??????tracking=dst
> count=10??seconds=10?
> | gen-id=1??????sig-id=3273???????type=Threshold tracking=src
> count=5???seconds=2??
> | gen-id=1??????sig-id=2494???????type=Both??????tracking=dst
> count=20??seconds=60?
> | gen-id=1??????sig-id=2495???????type=Both??????tracking=dst
> count=20??seconds=60?
> | gen-id=1??????sig-id=2275???????type=Threshold tracking=dst
> count=5???seconds=60?
> | gen-id=1??????sig-id=1991???????type=Limit?????tracking=src
> count=1???seconds=60?
> | gen-id=1??????sig-id=2924???????type=Threshold tracking=dst
> count=10??seconds=60?
> | gen-id=1??????sig-id=2496???????type=Both??????tracking=dst
> count=20??seconds=60?
> | gen-id=1??????sig-id=2923???????type=Threshold tracking=dst
> count=10??seconds=60?
> +-----------------------[suppression]--------------------------------
> ----------
> | none
> ---------------------------------------------------------------------
> ----------
> Rule application order: activation->dynamic->pass->drop->sdrop->reject-
> > alert->log
> Verifying Preprocessor Configurations!
> WARNING: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
> WARNING: flowbits key 'smb.tree.create.llsrpc' is set but not ever
> checked.
> 33 out of 1024 flowbits in use.
>
> [ Port Based Pattern Matching Memory ]
> +- [ Aho-Corasick Summary ] -------------------------------------
> | Storage Format????: Full-Q?
> | Finite Automaton??: DFA
> | Alphabet Size?????: 256 Chars
> | Sizeof State??????: Variable (1,2,4 bytes)
> | Instances?????????: 215
> |?????1 byte states : 204
> |?????2 byte states : 11
> |?????4 byte states : 0
> | Characters????????: 64982
> | States????????????: 32135
> | Transitions???????: 872051
> | State Density?????: 10.6%
> | Patterns??????????: 5055
> | Match States??????: 3855
> | Memory (MB)???????: 17.00
> |???Patterns????????: 0.51
> |???Match Lists?????: 1.02
> |???DFA
> |?????1 byte states : 1.02
> |?????2 byte states : 14.05
> |?????4 byte states : 0.00
> +----------------------------------------------------------------
> [ Number of patterns truncated to 20 bytes: 1039 ]
>
> ????????--== Initialization Complete ==--
>
> ???,,_?????-*> Snort! <*-
> ? o"??)~???Version 2.9.7.0 GRE (Build 149)?
> ???''''????By Martin Roesch & The Snort Team: http://www.snort.org/cont
> act#team
> ???????????Copyright (C) 2014 Cisco and/or its affiliates. All rights
> reserved.
> ???????????Copyright (C) 1998-2013 Sourcefire, Inc., et al.
> ???????????Using libpcap version 1.7.4
> ???????????Using PCRE version: 8.38 2015-11-23
> ???????????Using ZLIB version: 1.2.8
>
> ???????????Rules Engine: SF_SNORT_DETECTION_ENGINE??Version 2.4??<Build
> 1>
> ???????????Preprocessor Object: SF_SDF??Version 1.1??<Build 1>
> ???????????Preprocessor Object: SF_SSH??Version 1.1??<Build 3>
> ???????????Preprocessor Object: SF_SMTP??Version 1.1??<Build 9>
> ???????????Preprocessor Object: SF_REPUTATION??Version 1.1??<Build 1>
> ???????????Preprocessor Object: SF_SIP??Version 1.1??<Build 1>
> ???????????Preprocessor Object: SF_MODBUS??Version 1.1??<Build 1>
> ???????????Preprocessor Object: SF_DNS??Version 1.1??<Build 4>
> ???????????Preprocessor Object: SF_GTP??Version 1.1??<Build 1>
> ???????????Preprocessor Object: SF_FTPTELNET??Version 1.2??<Build 13>
> ???????????Preprocessor Object: SF_POP??Version 1.0??<Build 1>
> ???????????Preprocessor Object: SF_DNP3??Version 1.1??<Build 1>
> ???????????Preprocessor Object: SF_IMAP??Version 1.0??<Build 1>
> ???????????Preprocessor Object: SF_DCERPC2??Version 1.0??<Build 3>
> ???????????Preprocessor Object: SF_SSLPP??Version 1.1??<Build 4>
>
> Snort successfully validated the configuration!
> Snort exiting
> x@x /usr/local/bin $?
>
> --------------------------------------------------------------------
> The words Snort successfully validated the configuration! means it must
> of worked but ive yet to understand more about Snort and the WARNINGS.
>
> Thank you
>
> Paul
>
>
>
>
>
> ------------------------------
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
> ------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-users
>
>
> End of Snort-users Digest, Vol 132, Issue 24
> ********************************************


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!