[Snort-sigs] Duplicate sid:257; ????

Stephen Cravey cravey at ...520...
Fri Apr 19 18:05:41 EDT 2002


I was under the impression that no two signatures should have the same
SID. While perusing the snort rules, however, I came across SID # 257 in
dns.rules. There are two different versions of this signature in the file.

alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named
version attempt"; flags:A+;  content:"|07|version"; offset:12;
content:"|04|bind"; nocase; offset: 12; reference:arachnids,278;
classtype:attempted-recon; sid:257; rev:2;)

alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named
version attempt"; content:"|07|version"; offset:12; content:"|04|bind";
nocase; offset: 12; reference:arachnids,278; classtype:attempted-recon;
sid:257; rev:1;)

Is this correct? I'm trying to write some signature management code for
myself and this pretty much stopped me in my tracks. I got the file from
http://www.snort.org/dl/signatures/snortrules.tar.gz this afternoon.
What does snort do when it encounters this?

I noticed that someone else has already reported this on 4/9, but there
was no answer posted to the mailing list.

Thank you.

-Stephen





More information about the Snort-sigs mailing list