ALERT ORDERING--------------The Snort 2.0 detection engine changes how the ordering of rulesaffect which alerts fire.  Before Snort 2.0, knowing which alerts would firefirst was determined by the position of the rule during initialization.If the rule was read before another rule, then the rule that was read firstwould be the alert that was logged.This has all changed with the 2.0 detection engine.  There are now two stagesthat determine which alerts will fire for a packet.  Ideally, Snort would havethe ability to log all alerts in a packet, but the current output modules donot allow for this.The first stage in the 2.0 detection engine is rule set selection.  Dependingon the rule set that is selected, different alerts may be generated.  Therule sets are select first by transport protocol and then by characteristicswithin the specific transport protocol:  * TCP/UDP:  selection based on source and destination ports  * ICMP:     selection based on ICMP type  * IP:       selection based on IP transport protocol (if not TCP/UDP/ICMP)Each protocol also has a generic rule set associated with it.  This providesfor the case where a packet does not match any unique properties of thetransport protocol.It is important to note that every packet matches against a generic rule set,since every unique rule set includes the generic rule set.  For example, ifa packet with a destination port of 80 is inspected, the rule set thatcontains destination port 80 rules is selected, not the generic rule set.The rule set selected is important.  In the second stage of the 2.0detection engine, which rules get matched are determined by the rule set thatis selected.Once a rule set is selected, two general types of rules are matched against.These rules are content and non-content rules.  The content rules havehigher rule ordering priority over non-content rules, so if a content rulematches a packet and a non-content rule matches a packet, the content rulewill always win.  If no content rules match, then the non-content rule thatis first in the file (the old snort way) will win.  This doesn'tapply when a unique rule set has been selected because the unique non-contentrules are first in the inspection order.  For example,  if an ICMP packet oftype 8 is inspected, two rules will match the packet.  One of the rulesis a generic ICMP Echo Request with no type indicated, and the other rule isan ICMP Echo Request with a itype:8.  The itype:8 rule will always fire regardless of it's position in the rule file because it is the more uniquerule (since it has an itype:8).-- Examples --Which rule fires when there are two identical rules:alert tcp any any -> any any ( msg:"foo1"; content: "foo"; )alert tcp any any -> any any ( msg:"foo2"; content: "foo"; )foo1 fires because it is first in the rules file.  This applies for all rules(uricontent, content, no-content) that are exactly the same.  The first rulein the rule files alerts.Which rule fires when there are two rule with the same content, but one rulehas any any ports and the other has a specific port?alert tcp any any -> any any ( msg:"foo1"; content: "foo"; )alert tcp any any -> any 80 ( msg:"foo2"; content: "foo"; )foo2 fires because it is considered a unique rule because it specifies a portand gets put in the unique rule group for port 80.  foo1 is considered a generic rule because it has no specific port characteristics.Which rule fires when a uricontent rule and a content rule both match apacket?alert tcp any any -> any 80 ( msg:"foo1"; content: "foo"; )alert tcp any any -> any 80 ( msg:"foo2"; uricontent: "foo"; )foo2 fires (as long as http_inspect is on) because uricontent rules arematched against the packet first, and if there is a uricontent match thenthis rule takes priority over content and no-content rules.Which rule fires when a content rule and a no-content rule both match apacket?alert tcp any any -> any any ( msg:"foo1"; content: "foo"; )alert tcp any any -> any any ( msg:"foo2"; )foo1 fires because content rules are matched against a packet first, and ifthere is a content match, then any no-content rules that match the packetalso will take a lower priority than any content rule that matches a packet.Which rule fires when two content rules match a packet?alert tcp any any -> any any ( msg:"foo1"; content: "foo"; )alert tcp any any -> any any ( msg:"foo2"; content: "foobar";)foo2 fires because the content rule with the longer content string takesthe higher priority.Which rule fires when two ICMP rules match a packet?alert icmp any any -> any any ( msg:"ICMP-No-iType"; dsize:>800; )alert icmp any any -> any any ( msg:"ICMP-iType"; itype:8; dsize:>800;)ICMP-iType fires because it has an 'itype' parameter, which specifies theICMP rule as unique ('itype' is the only parameter for ICMP rules thatspecify uniqueness, otherwise it's considered generic).