[Snort-users] snort rule firing order

Kretzer, Jason R (Big Sandy) jason.kretzer at ...13486...
Tue Sep 13 07:31:08 EDT 2005


Hello all,
 
I have a custom rule that I would like to fire instead of a pre-built
rule.  Here is my rule
 
jason at ...13490...:~$ cat /etc/snort/rules/jason.rules
alert ip any any -> !224.0.0.13 any (msg:"BAD-TRAFFIC IP Proto 103 PIM";
ip_proto:103; reference:bugtraq,8211; reference:cve,2003-0567;
classtype:non-standard-protocol; sid:1002189; rev:1;)

It is exactly the same as rule 2189 in
/etc/snort/rules/bad-traffic.rules EXCEPT the destination IP, sid, and
rev.
 
I thought my rule would take precedence because it is more "specific"
than the given rule.  I would comment it out but oinkmaster which I use
to update my rules automatically just replaces it.
 
Is there something I am doing wrong?
 
-Jason
 
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050913/b91c3044/attachment.html>


More information about the Snort-users mailing list