0

When i execute

sudo suricata -i enp0s8 -c suricata.yaml -s rules/misreglas.rules 

Get the output:

<Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "drop http $HOME_NET any -> any any (msg: "HTTP DROP";)"

<Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> any any (msg: "HTTP DROP";)" from file rules/misreglas.rules at line 1

misreglas.rules content

drop http $HOME_NET any -> any any (msg: "HTTP DROP";)

1 Answer 1

0

You have to put the rules like that:

drop ICMP any any -> 169.69.1.11 any (msg: "test";sid:10001;)
drop HTTP $HOME_NET any -> any any (msg: "HTTP DROP";sid:10002;)

where I put sid you have to put and sid that is not already in use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.