What is the range of values for the 'priority' parameter in a Snort rule? The documentation it doesn't make it clear:

The priority tag assigns a severity level to rules. A classtype rule assigns a default priority (defined by the config classification option) that may be overridden with a priority rule. Examples of each case are given below.


priority:<priority integer>;


alert tcp any any -> any 80 (msg:"WEB-MISC phf attempt"; flags:A+; \ content:"/cgi-bin/phf"; priority:10;)

alert tcp any any -> any 80 (msg:"EXPLOIT ntpdx overflow"; \ dsize:>128; classtype:attempted-admin; priority:10 );

  • Refer to classification.config
    – Mr.kang
    Jan 2, 2018 at 15:36
  • Thanks, that's useful. So in classification.config it says that priority can be manually overridden and set to 10. Is the range from 0 (lowest severity) to 10 (highest severity)?
    – Astrophe
    Jan 2, 2018 at 15:44
  • The range is elastic. If you change the classification.config, you can change the range as many as you want
    – Mr.kang
    Jan 2, 2018 at 18:36

1 Answer 1


The short answer:

Whatever your heart desires. Just tested up to priority:1000000; and works just fine.

What it says in the manual:

The following was put under §3.4.6 - classtype, the section immediately preceding priority:

Attack classifications defined by Snort reside in the classification.config file. The file uses the following syntax:

config classification: <class name>,<class description>,<default priority>

These attack classifications are listed in Table 3.2. They are currently ordered with 4 default priorities. A priority of 1 (high) is the most severe and 4 (very low) is the least severe.

Hope this answers your question!

  • It's understandable. If I wrote it, I would have put that information in the "priority" section. Snort is an excellent IDS/IPS and has some of the best documentation out there, but it is strewn across a huge manual plus all of the different README files, and even some of the content is ambiguous at best. A lot of learning Snort, I find, is trial and error.
    – Damian T.
    Jan 3, 2018 at 20:52
  • It is very good overall. I've read the documentation several times now so I prefer to ask a question if I can't get the information from the appropriate section or through a quick word search.
    – Astrophe
    Jan 3, 2018 at 21:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .