Snort mailing list archives
snort rule firing order
From: "Kretzer, Jason R (Big Sandy)" <jason.kretzer () kctcs edu>
Date: Tue, 13 Sep 2005 10:32:00 -0400
Hello all, I have a custom rule that I would like to fire instead of a pre-built rule. Here is my rule jason@bgswebtest:~$ cat /etc/snort/rules/jason.rules alert ip any any -> !224.0.0.13 any (msg:"BAD-TRAFFIC IP Proto 103 PIM"; ip_proto:103; reference:bugtraq,8211; reference:cve,2003-0567; classtype:non-standard-protocol; sid:1002189; rev:1;) It is exactly the same as rule 2189 in /etc/snort/rules/bad-traffic.rules EXCEPT the destination IP, sid, and rev. I thought my rule would take precedence because it is more "specific" than the given rule. I would comment it out but oinkmaster which I use to update my rules automatically just replaces it. Is there something I am doing wrong? -Jason
Current thread:
- snort rule firing order Kretzer, Jason R (Big Sandy) (Sep 13)
- <Possible follow-ups>
- RE: snort rule firing order Joshua Berry (Sep 13)