From 7fcc9a50669080b998c18988e3ffcd396e0cd004 Mon Sep 17 00:00:00 2001 From: Corey Thomas Date: Tue, 2 Mar 2021 11:16:21 -0500 Subject: [PATCH] rules/decoder-events: fix duplicate sid --- rules/decoder-events.rules | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/decoder-events.rules b/rules/decoder-events.rules index 3dea158ac1..515e93325d 100644 --- a/rules/decoder-events.rules +++ b/rules/decoder-events.rules @@ -143,6 +143,6 @@ alert pkthdr any any -> any any (msg:"SURICATA ERSPAN too many vlan layers"; dec # Cisco Fabric Path/DCE alert pkthdr any any -> any any (msg:"SURICATA DCE packet too small"; decode-event:dce.pkt_too_small; classtype:protocol-command-decode; sid:2200110; rev:2;) -alert pkthdr any any -> any any (msg:"SURICATA packet with too many layers"; decode-event:too_many_layers; classtype:protocol-command-decode; sid:2200111; rev:1;) -# next sid is 2200112 +alert pkthdr any any -> any any (msg:"SURICATA packet with too many layers"; decode-event:too_many_layers; classtype:protocol-command-decode; sid:2200116; rev:1;) +# next sid is 2200117