Project

General

Profile

Actions
Copy link

Bug #2102

closed

Rules with dual sid do not error

Added by Francis Trudeau almost 7 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Andreas Herz
Target version:
4.0.1
Affected Versions:
Effort:
Difficulty:
Label:

Description

The following rules do not error in Suricata 3.2.1 or Suricata version 4.0dev (rev 3ff5dc3):

alert tcp any any -> any any (msg:"DUAL SID TEST"; content:"10dc303535874aeccc86a8251e6992f5"; sid:3031; sid:3031; rev:1;)

alert tcp any any -> any any (msg:"DUAL SID TEST"; content:"10dc303535874aeccc86a8251e6992f5"; sid:3032; sid:3033; rev:1;)

It appears to pick the latter one when presented with two:

09/12/2016-14:51:13.407898 [**] [1:3033:1] DUAL SID TEST [**] [Classification: (null)] [Priority: 3] {TCP} 172.16.71.200:42439 -> 172.16.71.162:88

Actions
Copy link
 #1

Updated by Andreas Herz almost 7 years ago

  • Assignee set to Andreas Herz
  • Target version set to TBD
Actions
Copy link
 #2

Updated by Andreas Herz over 6 years ago

  • Status changed from New to Closed
Actions
Copy link
 #3

Updated by Andreas Herz over 6 years ago

  • Target version changed from TBD to 4.0.1
Actions
Copy link

Also available in: Atom PDF