Re: Another Snort Rules Question

[Erik Fichtner <emf () servervault com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Sep 07, 2004 at 04:38:31PM -0700, Scott Elgram wrote:
> Hello again,
>     I have 2 rules....(yes this is pointless and bad practice, I know, just bare with me here).
>
> alert icmp 192.168.0.31 any -> 192.168.0.240 any (msg: "Test ICMP ping 1";)
> alert icmp 192.168.0.31 any -> 192.168.0.240 any (msg: "Test ICMP ping 2";)
>
>     Ok, I am 192.168.31 and I ping 192.168.0.240........In ACID I get 2 alerts.  One for msg: "Test ICMP ping 1" and 
> one for "Test ICMP ping 2".  Now, I could be wrong here but I thought after a packet is shown true to a rule Snort 
> stops comparing the packet to rules.

in 2.2.0RC1, they added multiple events in "event_queue". see doc/README.event_queue.
You can tune how many alerts will fire on a particular event.  If you're in an
environment where you're alerting on more generic misbehavior and have some
back-end processor that can handle multiple alerts, it's pretty cool stuff.
Otherwise, it can be a little noisier than usual. 


- -- 
Erik Fichtner
Principal Engineer, Information Security, ServerVault Corp.
703-652-5900
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)

iD8DBQFBPkx1Q7EzrewLMS0RAox2AJ9JiMsty53l35OUPukcwLrOXRsbBgCfcsKh
UJueidsc77etLmireXNEYVA=
=cpxj
-----END PGP SIGNATURE-----


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users