<div dir="ltr">After poking around more, I'm actually convinced that this is not 'one alert when multiple should hit' and more like, 'duplicate alerts for some reason I don't understand'.<div>For example, in a pcap that *should* generate 6 alerts each for ET sid:2014636 and my custom signature sid:6000300 I end up with 6 for my custom signature, and 12 for the ET one. I see this in reverse in some other situations (custom one generates twice as many as the ET one, or similar).</div><div><br></div><div>I can provide a pcap and discuss in more detail off list if required.</div><div>Here's some output from fast.log, I've highlighted two examples of the sessions that are triggering twice, for a session, but it applies to all of them:</div><div><br></div><div><div>11/14/2014-19:16:32.504795 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <span style="background-color:rgb(255,0,0)"><a href="http://172.18.146.177:28902">172.18.146.177:28902</a> -> <a href="http://222.173.114.183:8000">222.173.114.183:8000</a></span></div><div>11/14/2014-19:16:32.505110 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <span style="background-color:rgb(255,153,0)"><a href="http://172.18.64.119:57347">172.18.64.119:57347</a> -> <a href="http://222.173.153.246:8000">222.173.153.246:8000</a></span></div><div>11/14/2014-19:16:32.504636 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.26.130.134:12970">172.26.130.134:12970</a> -> <a href="http://222.173.21.225:8000">222.173.21.225:8000</a></div><div>11/14/2014-19:16:32.504951 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.29.155.57:20046">172.29.155.57:20046</a> -> <a href="http://222.173.107.190:8000">222.173.107.190:8000</a></div><div>11/14/2014-19:16:32.504473 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.31.5.222:62805">172.31.5.222:62805</a> -> <a href="http://222.173.45.128:8000">222.173.45.128:8000</a></div><div>11/14/2014-19:16:32.505268 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.27.217.69:12308">172.27.217.69:12308</a> -> <a href="http://222.173.182.193:8000">222.173.182.193:8000</a></div><div><br></div><div>11/14/2014-19:16:32.505619 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.26.130.134:12970">172.26.130.134:12970</a> -> <a href="http://222.173.21.225:8000">222.173.21.225:8000</a></div><div>11/14/2014-19:16:32.505619 [**] [1:6000300:1] MY OTHER RULE NAME [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.26.130.134:12970">172.26.130.134:12970</a> -> <a href="http://222.173.21.225:8000">222.173.21.225:8000</a></div><div><br></div><div>11/14/2014-19:16:32.505619 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <span style="background-color:rgb(255,153,0)"><a href="http://172.18.64.119:57347">172.18.64.119:57347</a> -> <a href="http://222.173.153.246:8000">222.173.153.246:8000</a></span></div><div>11/14/2014-19:16:32.505619 [**] [1:6000300:1] MY OTHER RULE NAME [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <span style="background-color:rgb(255,153,0)"><a href="http://172.18.64.119:57347">172.18.64.119:57347</a> -> <a href="http://222.173.153.246:8000">222.173.153.246:8000</a></span></div><div><br></div><div>11/14/2014-19:16:32.505619 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.29.155.57:20046">172.29.155.57:20046</a> -> <a href="http://222.173.107.190:8000">222.173.107.190:8000</a></div><div>11/14/2014-19:16:32.505619 [**] [1:6000300:1] MY OTHER RULE NAME [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.29.155.57:20046">172.29.155.57:20046</a> -> <a href="http://222.173.107.190:8000">222.173.107.190:8000</a></div><div><br></div><div>11/14/2014-19:16:32.505619 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.31.5.222:62805">172.31.5.222:62805</a> -> <a href="http://222.173.45.128:8000">222.173.45.128:8000</a></div><div>11/14/2014-19:16:32.505619 [**] [1:6000300:1] MY OTHER RULE NAME [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.31.5.222:62805">172.31.5.222:62805</a> -> <a href="http://222.173.45.128:8000">222.173.45.128:8000</a></div><div><br></div><div>11/14/2014-19:16:32.505619 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <span style="background-color:rgb(255,0,0)"><a href="http://172.18.146.177:28902">172.18.146.177:28902</a> -> <a href="http://222.173.114.183:8000">222.173.114.183:8000</a></span></div><div>11/14/2014-19:16:32.505619 [**] [1:6000300:1] MY OTHER RULE NAME [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <span style="background-color:rgb(255,0,0)"><a href="http://172.18.146.177:28902">172.18.146.177:28902</a> -> <a href="http://222.173.114.183:8000">222.173.114.183:8000</a></span></div><div><br></div><div>11/14/2014-19:16:32.505619 [**] [1:2014636:3] ET TROJAN Backdoor.Win32/Poison.BI [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.27.217.69:12308">172.27.217.69:12308</a> -> <a href="http://222.173.182.193:8000">222.173.182.193:8000</a></div><div>11/14/2014-19:16:32.505619 [**] [1:6000300:1] MY OTHER RULE NAME [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} <a href="http://172.27.217.69:12308">172.27.217.69:12308</a> -> <a href="http://222.173.182.193:8000">222.173.182.193:8000</a></div></div><div><br></div><div>./d</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Nov 17, 2014 at 3:09 PM, Victor Julien <span dir="ltr"><<a href="mailto:lists@inliniac.net" target="_blank">lists@inliniac.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 11/17/2014 08:26 PM, Duane Howard wrote:<br>
> I have a pcap from a sample that I have a few similar rules for, they<br>
> effectively look for the same content, in slightly different ways (one<br>
> internal, one from VRT). When I run Snort over the pcap this particular<br>
> session, I get an alert for each signature in question. When using<br>
> Suricata I only get an alert from one of these rules. Does Suricata bail<br>
> on rule comparisons after a single alert occurs?<br>
<br>
</div></div>No. There must be another reason the other rules don't match. What<br>
happens if you run the rules individually?<br>
<br>
The only thing that could cause us to stop inspecting rules prematurely<br>
is when a 'pass' rule matches.<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Training now available: <a href="http://suricata-ids.org/training/" target="_blank">http://suricata-ids.org/training/</a><br>
</font></span></blockquote></div><br></div>