Project

General

Profile

Actions

Support #3530

closed

Fail to start under widows with [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature

Added by Fox Edogawa over 4 years ago. Updated about 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Affected Versions:
Label:
Beginner

Description

Sorry to brother you ! I installed version 5.0.1 under windows 10 correctly.

I have tested the yaml:
D:\suricata>suricata.exe -c suricata.yaml -T
[11412] 16/3/2020 -- 10:44:42 - (win32-service.c:53) <Info> (SCRunningAsService) -- Running as service: no
[11412] 16/3/2020 -- 10:44:42 - (suricata.c:1905) <Info> (ParseCommandLine) -- Running suricata under test mode
[11412] 16/3/2020 -- 10:44:42 - (suricata.c:1083) <Notice> (LogVersion) -- This is Suricata version 5.0.1 RELEASE running in SYSTEM mode
[11412] 16/3/2020 -- 10:44:42 - (suricata.c:3060) <Notice> (main) -- Configuration provided was successfully loaded. Exiting.

Issuing the initial test command:
suricata.exe -c suricata.yaml -s D:\suricata\rules\local.rules -i 192.168.0.105

I get the following two repeating error types:
SC_ERR_DUPLICATE_SIG(176) - Duplicate signature
SC_ERR_INVALID_SIGNATURE(39) - error parsing signature

D:\suricata>suricata.exe -c suricata.yaml -s D:\suricata\rules\local.rules -i 192.168.0.105
[4308] 16/3/2020 -- 10:29:17 - (win32-service.c:53) <Info> (SCRunningAsService) -- Running as service: no
[4308] 16/3/2020 -- 10:29:20 - (suricata.c:1152) <Info> (ParseCommandLinePcapLive) -- translated 192.168.0.105 to pcap device \Device\NPF_{1ED6D1E9-B4CD-4389-9DDE-DE78FFB2D2B2}
[4308] 16/3/2020 -- 10:29:20 - (suricata.c:1083) <Notice> (LogVersion) -- This is Suricata version 5.0.1 RELEASE running in SYSTEM mode
[4308] 16/3/2020 -- 10:29:20 - (tm-threads.c:2164) <Notice> (TmThreadWaitOnThreadInit) -- all 5 packet processing threads, 4 management threads initialized, engine started.
[4308] 16/3/2020 -- 10:29:20 - (detect-engine.c:4007) <Notice> (DetectEngineReload) -- rule reload starting
[4308] 16/3/2020 -- 10:29:20 - (detect-parse.c:2310) <Error> (DetectEngineAppendSig) -- [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http any any -> $EXTERNAL_NET any (msg:"hit baidu.com...";content:"baidu"; reference:url, www.baidu.com; sid:2229998; rev:2;)"
[4308] 16/3/2020 -- 10:29:20 - (detect-engine-loader.c:184) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http any any -> $EXTERNAL_NET any (msg:"hit baidu.com...";content:"baidu"; reference:url, www.baidu.com; sid:2229998; rev:2;)" from file D:\suricata\rules\local.rules at line 1
[4308] 16/3/2020 -- 10:29:20 - (detect-engine.c:4078) <Notice> (DetectEngineReload) -- rule reload complete
[4308] 16/3/2020 -- 10:29:20 - (suricata.c:2592) <Notice> (PostRunStartedDetectSetup) -- Signature(s) loaded, Detect thread(s) activated.

I have noticed the same problem like mine before. But I didn't get the exactly way to solve it. As I am a newbie into Suricata IDS, can you suggest possible corrections to have it start up properly?


Files

suricata.yaml (70.9 KB) suricata.yaml Fox Edogawa, 03/16/2020 02:43 AM
local.rules (131 Bytes) local.rules Fox Edogawa, 03/16/2020 02:43 AM
D7AB0006-8766-4444-807E-B3361749812A.png (119 KB) D7AB0006-8766-4444-807E-B3361749812A.png The warning Fox Edogawa, 03/16/2020 05:01 PM
Actions

Also available in: Atom PDF