Snort not starting with simple custom rule
-
Hello,
i have installed snort, afther the installation all ok, snort start without any problems so tried to add a simple custom rule: alert icmp any any -> any any (msg: "ICMP Packet found";)
After adding this rule snort will not start anymore. In the system log there is only: php-fpm[50464]: /snort/snort_interfaces.php: [Snort] Building new sig-msg.map file for WAN…
Any help would be appreciated, thanks.
-
Missing some parts of the rule.. Ensure you use a SID number that is not used.. Keeping it in the 9000000's should be safe, also you can change the classtype to any other existing classtype as you wish…
alert icmp any any -> any any (msg: "ICMP Packet found"; classtype:attempted-recon; sid:9000001; rev:1;)
-
Thanks for this, now the rule works great :)
