[Snort-users] Oinkmaster Update

Andreas Östling andreaso at ...236...
Mon Oct 24 03:36:00 EDT 2005


On Monday 24 October 2005 05:01, Bill Parker wrote:
> Hi All,
>
>     I was doing my weekly check through for oinkmaster, and I got the
> following messages:
...
> WARNING: duplicate SID in downloaded archive, SID=3156
...
> Has anyone else seen this behavior with OinkMaster?

They introduced rules with duplicate sids in the rules archives again
(it has nothing to do with Oinkmaster except that it will detect it and 
warn you). snortrules-snapshot-2.3.tar.gz currently contains dups for 
sid 3157, 3156, 2190, 3197. snortrules-snapshot-2.4.tar.gz contains dup 
for sid 2350. Oinkmaster will only keep the rule with the highest 
revision number so it's harmless but annoying.

/Andreas





More information about the Snort-users mailing list