SURICATA - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)]

Question

当我执行

sudo suricata -i enp0s8 -c suricata.yaml -s rules/misreglas.rules 

得到输出：

<Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "drop http $HOME_NET any -> any any (msg: "HTTP DROP";)"

<Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> any any (msg: "HTTP DROP";)" from file rules/misreglas.rules at line 1

misreglas.rules含量

drop http $HOME_NET any -> any any (msg: "HTTP DROP";)

Answer 1

你必须把规则写成这样：

drop ICMP any any -> 169.69.1.11 any (msg: "test";sid:10001;)
drop HTTP $HOME_NET any -> any any (msg: "HTTP DROP";sid:10002;)

在我放的地方，你必须把它放进去，而且它还没有开始使用。