[Snort-users] Duplicate downloaded rules

Lay, James james.lay at ...15009...
Tue Oct 19 10:04:51 EDT 2010


I sent this to snort-sigs a few days ago, but it got moderated into
oblivion.  Here's a pruned down one in hopes it will make it:

 

I am seeing the below with grabbing these rulesets:

 

Downloading file from
http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapsh
ot-2900.tar.gz

Downloading file from
http://rules.emergingthreats.net/open/snort-2.8.6/emerging.rules.tar.gz

 

WARNING: duplicate SID in downloaded archive, SID=498, only keeping rule
with highest 'rev'

WARNING: duplicate SID in downloaded archive, SID=494, only keeping rule
with highest 'rev'

WARNING: duplicate SID in downloaded archive, SID=495, only keeping rule
with highest 'rev'

WARNING: duplicate SID in downloaded archive, SID=497, only keeping rule
with highest 'rev'

<snip> many more of these

WARNING: duplicate SID in downloaded archive, SID=1666, only keeping
rule with highest 'rev'

WARNING: duplicate SID in downloaded archive, SID=1988, only keeping
rule with highest 'rev'

WARNING: duplicate SID in downloaded archive, SID=1989, only keeping
rule with highest 'rev'

 

A grand total of 409 dup messages are seen even as of this morning.
Maybe this one will make it through...

 

James

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20101019/1023209a/attachment.html>


More information about the Snort-users mailing list