[Snort-users] Another Snort Rules Question
emf at ...367...
Tue Sep 7 17:05:00 EDT 2004
-----BEGIN PGP SIGNED MESSAGE-----
On Tue, Sep 07, 2004 at 04:38:31PM -0700, Scott Elgram wrote:
> Hello again,
> I have 2 rules....(yes this is pointless and bad practice, I know, just bare with me here).
> alert icmp 192.168.0.31 any -> 192.168.0.240 any (msg: "Test ICMP ping 1";)
> alert icmp 192.168.0.31 any -> 192.168.0.240 any (msg: "Test ICMP ping 2";)
> Ok, I am 192.168.31 and I ping 192.168.0.240........In ACID I get 2 alerts. One for msg: "Test ICMP ping 1" and one for "Test ICMP ping 2". Now, I could be wrong here but I thought after a packet is shown true to a rule Snort stops comparing the packet to rules.
in 2.2.0RC1, they added multiple events in "event_queue". see doc/README.event_queue.
You can tune how many alerts will fire on a particular event. If you're in an
environment where you're alerting on more generic misbehavior and have some
back-end processor that can handle multiple alerts, it's pretty cool stuff.
Otherwise, it can be a little noisier than usual.
Principal Engineer, Information Security, ServerVault Corp.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)
-----END PGP SIGNATURE-----
More information about the Snort-users