Snort mailing list archives
Re: Snort duplicate signatures in table
From: Dirk Geschke <Dirk_Geschke () genua de>
Date: Wed, 19 Apr 2006 12:49:46 +0200
Hi Vladimir,
Apr 18 19:10:58 gw1 snort[29259]: database: warning (SELECT sig_id FROM signature WHERE sig_name = 'WEB-MISC Cisco IOS HTTP configuration attempt' AND sig_rev = 13 AND sig_sid = 1250 ) returned more than one result This mean that packet going over 2 interfaces and on each snort detect suspicious traffic. Then snort execute 2 concurrent SELECT queries(1 by each snort process) to see does the signature exists in signature database. And then snort try to insert signature. I know that signature table does not have duplicated signatures but I don't know how to solve this problem.
are you sure about this? Maybe there are more rules with the same sig_name, sig_rev and sig_sid but with different priorities? Simply connect to the database and execute the SQL statement. Then you can easily see which other results are available. Use psql to connect to the database and then execute: SELECT * FROM signature WHERE sig_name = 'WEB-MISC Cisco IOS HTTP configuration attempt' AND sig_rev = 13 AND sig_sid = 1250; This should show all results with all fields. And probably you will find the answer what caused the above message... Best regards Dirk ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort duplicate signatures in table Vladimir (Apr 19)
- Re: Snort duplicate signatures in table Dirk Geschke (Apr 19)
- RE: Snort duplicate signatures in table Vladimir (Apr 19)
- Re: Snort duplicate signatures in table Dirk Geschke (Apr 19)
- RE: Snort duplicate signatures in table Vladimir (Apr 19)
- Re: Snort duplicate signatures in table Dirk Geschke (Apr 19)
- RE: Snort duplicate signatures in table Vladimir (Apr 20)
- Re: Snort duplicate signatures in table Dirk Geschke (Apr 20)
- RE: Snort duplicate signatures in table Vladimir (Apr 21)
- Re: Snort duplicate signatures in table Dirk Geschke (Apr 21)
- RE: Snort duplicate signatures in table Vladimir (Apr 19)
- Re: Snort duplicate signatures in table Dirk Geschke (Apr 19)