Preamble: I wanted to just add a comment first, as it's still rather unclear what might be causing your problem from the information you provide, but I ran out of space reserved for comments, so here goes my suggestion (no guarantees it's actually the case):
On what kind of a capture file you're trying to run Snort rules through is rather unclear both from your question, as well as your later comments. It's however possible that you're running your replay in a single packet capture mode, but from a file with many pcaps. That's what flag -r
implies (is the same as using -pcap-single=<file>
) and your comment that it works on some rule and not the other suggests this might be the case also (if in one instance the first packet capture would match your rules, while in another the pcap that would match your rules might not be the first one in the list of many). To make Snort replay process multiple pcaps from a single capture file, use -pcap-file=<file>
instead.
To be sure this is the case, you could test that with a -pcap-no-filter
flag and see if it iterates through all of them in the output. Other command line arguments relevant to your use-case are listed here.
Alternatively, you could change your rule to match all packets, and see how many results it returns:
alert udp any any -> any any (msg:"This should match all UDP packets in an input file";)
Other than this, I don't see any problems with your snort rule you gave in the example, and it follows Snort rules form properly.