[Snort-users] snort rule firing order
JBerry at ...11848...
Tue Sep 13 07:38:30 EDT 2005
You could tell oinkmaster to comment out the old rule with this:
Or you could tell oinkmaster to modify the sid and replace it with your
modifysid <sid_number> "alert ip any any -> any any \(msg:\"BAD-TRAFFIC
IP Proto 103 PIM" | "alert ip any any -> !18.104.22.168 any
\(msg:\"BAD-TRAFFIC IP Proto 103 PIM"
You might need a slash in front of the exclamation point as well.
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Kretzer,
Jason R (Big Sandy)
Sent: Tuesday, September 13, 2005 9:32 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] snort rule firing order
I have a custom rule that I would like to fire instead of a pre-built
rule. Here is my rule
jason at ...13490...:~$ cat /etc/snort/rules/jason.rules
alert ip any any -> !22.214.171.124 any (msg:"BAD-TRAFFIC IP Proto 103 PIM";
ip_proto:103; reference:bugtraq,8211; reference:cve,2003-0567;
classtype:non-standard-protocol; sid:1002189; rev:1;)
It is exactly the same as rule 2189 in
/etc/snort/rules/bad-traffic.rules EXCEPT the destination IP, sid, and
I thought my rule would take precedence because it is more "specific"
than the given rule. I would comment it out but oinkmaster which I use
to update my rules automatically just replaces it.
Is there something I am doing wrong?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users