Snort mailing list archives

snort rule firing order


From: "Kretzer, Jason R (Big Sandy)" <jason.kretzer () kctcs edu>
Date: Tue, 13 Sep 2005 10:32:00 -0400

Hello all,
 
I have a custom rule that I would like to fire instead of a pre-built
rule.  Here is my rule
 
jason@bgswebtest:~$ cat /etc/snort/rules/jason.rules
alert ip any any -> !224.0.0.13 any (msg:"BAD-TRAFFIC IP Proto 103 PIM";
ip_proto:103; reference:bugtraq,8211; reference:cve,2003-0567;
classtype:non-standard-protocol; sid:1002189; rev:1;)

It is exactly the same as rule 2189 in
/etc/snort/rules/bad-traffic.rules EXCEPT the destination IP, sid, and
rev.
 
I thought my rule would take precedence because it is more "specific"
than the given rule.  I would comment it out but oinkmaster which I use
to update my rules automatically just replaces it.
 
Is there something I am doing wrong?
 
-Jason
 
 

Current thread: