[Snort-sigs] Re: [Snort-users] Duplicate sid:257; ????

Brian bmc at ...95...
Tue Apr 16 10:57:34 EDT 2002


According to Stephen Cravey:
> I was under the impression that no two signatures should have the same
> SID. While perusing the snort rules, however, I came across SID # 257 in
> dns.rules. There are two different versions of this signature in the file.
> 
> alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named
> version attempt"; flags:A+;  content:"|07|version"; offset:12;
> content:"|04|bind"; nocase; offset: 12; reference:arachnids,278;
> classtype:attempted-recon; sid:257; rev:2;)
> 
> alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named
> version attempt"; content:"|07|version"; offset:12; content:"|04|bind";
> nocase; offset: 12; reference:arachnids,278; classtype:attempted-recon;
> sid:257; rev:1;)
> 
> Is this correct? I'm trying to write some signature management code for
> myself and this pretty much stopped me in my tracks. I got the file from
> http://www.snort.org/dl/signatures/snortrules.tar.gz this afternoon.
> What does snort do when it encounters this?

This has been corrected in CURRENT.  I've just corrected it in stable.
Give it about 2 hours and the version available on the website should
be corrected.

-brian




More information about the Snort-sigs mailing list