0

What is the range of values for the 'priority' parameter in a Snort rule? The documentation it doesn't make it clear:

The priority tag assigns a severity level to rules. A classtype rule assigns a default priority (defined by the config classification option) that may be overridden with a priority rule. Examples of each case are given below.

Format

priority:<priority integer>;

Examples

alert tcp any any -> any 80 (msg:"WEB-MISC phf attempt"; flags:A+; \ content:"/cgi-bin/phf"; priority:10;)

alert tcp any any -> any 80 (msg:"EXPLOIT ntpdx overflow"; \ dsize:>128; classtype:attempted-admin; priority:10 );

  • Refer to classification.config – Mr.kang Jan 2 '18 at 15:36
  • Thanks, that's useful. So in classification.config it says that priority can be manually overridden and set to 10. Is the range from 0 (lowest severity) to 10 (highest severity)? – Astrophe Jan 2 '18 at 15:44
  • The range is elastic. If you change the classification.config, you can change the range as many as you want – Mr.kang Jan 2 '18 at 18:36
1

The short answer:

Whatever your heart desires. Just tested up to priority:1000000; and works just fine.

What it says in the manual:

The following was put under §3.4.6 - classtype, the section immediately preceding priority:

Attack classifications defined by Snort reside in the classification.config file. The file uses the following syntax:

config classification: <class name>,<class description>,<default priority>

These attack classifications are listed in Table 3.2. They are currently ordered with 4 default priorities. A priority of 1 (high) is the most severe and 4 (very low) is the least severe.

Hope this answers your question!

  • It's understandable. If I wrote it, I would have put that information in the "priority" section. Snort is an excellent IDS/IPS and has some of the best documentation out there, but it is strewn across a huge manual plus all of the different README files, and even some of the content is ambiguous at best. A lot of learning Snort, I find, is trial and error. – Damian T. Jan 3 '18 at 20:52
  • It is very good overall. I've read the documentation several times now so I prefer to ask a question if I can't get the information from the appropriate section or through a quick word search. – Astrophe Jan 3 '18 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.