Groups
Sign in
Groups
pulledpork users
Conversations
About
Send feedback
Help
duplicate rules
187 views
Skip to first unread message
Jeremy Hoel
unread,
Oct 3, 2013, 1:46:53 PM
10/3/13
Reply to author
Sign in to reply to author
Forward
Sign in to forward
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to pulledpo...@googlegroups.com
When using registered VRT rules AND the community ruleset (which gets
updated more often from what's been put out), you end up with
duplicate rules.
ie:
WARNING: /etc/snort/rules/snort.rules(20104) GID 1 SID 560 in rule
duplicates previous rule. Ignoring old rule.
WARNING: /etc/snort/rules/snort.rules(20561) GID 1 SID 21255 in rule
duplicates previous rule. Ignoring old rule.
WARNING: /etc/snort/rules/snort.rules(20562) GID 1 SID 21256 in rule
duplicates previous rule. Ignoring old rule
So, does PP have a method in place in order to choose one rule over the other?
Can you set a preferred priority for the rule packs in this case?
Or is there something in snort that chooses the newer rule?
Or am I missing something else?
Thanks..
Reply all
Reply to author
Forward
0 new messages