Suricata

If a packet matches on more than one rule the last verdict parsed is the verdict that is set. For example with this request.

http://www.google.com/applesoranges

I get the following two alerts.

01/28/10-03:44:00.772119 [**] [1:2000:0] apples [**] [Classification: (null)] [Priority: 3] {6} 192.168.2.3:40674 -> 74.125.95.147:80
01/28/10-03:44:00.772119 [**] [1:2001:0] oranges [**] [Classification: (null)] [Priority: 3] {6} 192.168.2.3:40674 -> 74.125.95.147:80

If the following rules are loaded in this order then no packets are dropped.

drop tcp any any -> any any (msg:"apples"; uricontent:"apples"; sid:2000;)
alert tcp any any -> any any (msg:"oranges"; uricontent:"oranges"; sid:2001;)

If rules are loaded in this order

alert tcp any any -> any any (msg:"oranges"; uricontent:"oranges"; sid:2001;)
drop tcp any any -> any any (msg:"apples"; uricontent:"apples"; sid:2000;)

The packet is indeed dropped. The default mode of operation should be that drop/reject/sdrop overrides alert. Perhaps we can add an option to make this order user configurable.