Guidelines for importing custom Snort 2 rules

Use these guidelines to import custom standard text rules for use in Snort 2 intrusion policies.

File and rule syntax requirements

Import rules using a rule file that meets these requirements:

  • Use a plain text file encoded in ASCII or UTF-8.

  • Use only alphanumeric characters, spaces, underscores (_), periods (.), and hyphens (-) in the file name.

  • To import a rule in the deleted state, precede it with one number sign (#). A rule preceded by two number signs (##) is not imported.

  • Do not use escape characters in rules.

  • Limit each source or destination port list to 64 characters. A longer list causes the import to fail.

For more information on writing custom rules, refer to Custom Snort 2 Intrusion Policies for Access Control and to the Snort manual at http://www.snort.org.

SID, GID, and revision number requirements

Follow these requirements for SIDs, GIDs, and revision numbers:

  • Do not specify a GID. A standard text rule receives GID 1.

  • Leave the SID and revision number unspecified when importing a rule for the first time. The rule receives an available SID of 1000000 or greater and a revision number of 1.

  • If you must specify a SID for a new rule, use an unassigned value from 1000000 through 2147483647 (the 32-bit limit).

  • When importing an updated or previously deleted rule, include its assigned SID and a revision number greater than its current revision number.

To determine the current revision number, edit the imported rule. Deleting a custom rule moves it to the deleted rule category and increments its revision number. You can then import a later revision to reinstate the rule.