Home page logo

snort logo Snort mailing list archives

Re: How rules fire question.
From: "AT&T.Net" <coppage () att net>
Date: Mon, 6 May 2013 13:19:40 -0400

Thank Joe,
     In looking how this box was set up, pulled pork is being used on a central server but one of the scripts being 
used to push the rules and that file to all the sensors was pulling from the wrong location and therefore the correct 
Sid file was not being pushed. 


Sent from mobile device via my thumbs. 

On May 6, 2013, at 11:06 AM, Joel Esler <jesler () sourcefire com> wrote:

On May 6, 2013, at 10:59 AM, "AT&T.Net" <coppage () att net> wrote:

      My snort is giving me an alert for example. Snort Alert [1:24889:0]. When I look at my snort.rules file there 
is rev 1 but not a rev 0. If the last number is referencing the rev, why would it have fired on a non existing rev?  
I've searched my old archived rules on the server and other rules and don't have that SID with a rev 0. 

That rule is at rev:1.  We start all rules at Rev 1.  

So, I am thinking two things

#1 -- You aren't using pulledpork to manage your downloads (which as part of it's download and managing process, it 
creates the sid-msg.map for you)
#2 -- Your barnyard2 instance isn't reading the sid-msg.map file that pulledpork generates.

Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]