Hi Vladimir,
Apr 18 19:10:58 gw1 snort[29259]: database: warning (SELECT sig_id FROM
signature WHERE sig_name = 'WEB-MISC Cisco IOS HTTP configuration attempt'
AND sig_rev = 13 AND sig_sid = 1250 ) returned more than one result
This mean that packet going over 2 interfaces and on each snort detect
suspicious traffic. Then snort execute 2 concurrent SELECT queries(1 by each
snort process) to see does the signature exists in signature database. And
then snort try to insert signature.
I know that signature table does not have duplicated signatures but I don't
know how to solve this problem.
are you sure about this? Maybe there are more rules with the same sig_name,
sig_rev and sig_sid but with different priorities?
Simply connect to the database and execute the SQL statement. Then you can
easily see which other results are available. Use psql to connect to the
database and then execute:
SELECT * FROM signature WHERE sig_name = 'WEB-MISC Cisco IOS HTTP configuration
attempt' AND sig_rev = 13 AND sig_sid = 1250;
This should show all results with all fields. And probably you will find the
answer what caused the above message...
Best regards
Dirk
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
