How to specify a range of rule IDs

Help
1

Suricata v6.0.5 (I did searched the doc)

I use drop.conf to block IPs. Recently I added what I thought was a valid entry for a range of rule IDs. Not so?

#  ET TOR Known Tor Exit Node Traffic group 27 - 133
2520026-2520133

None of these IDs are dropped.

What is the correct syntax?

2

You use the drop.conf for suricata-update to generate the desired ruleset, correct?
Can you show the end result of the suricata-update run, so we can make sure those ET TOR rules are correctly converted to drop rules?

3

Ah. Silly me.

5/6/2022 -- 08:02:02 - <Warning> -- Failed to parse: "2520026-2520133"
5/6/2022 -- 08:02:02 - <Warning> -- Failed to parse: "2034660-2034699"
5/6/2022 -- 08:02:02 - <Warning> -- Failed to parse: "2034782-2034799"
5/6/2022 -- 08:02:02 - <Warning> -- Failed to parse: "2034800-2034839"

So what IS the correct syntax?

4

Looks like we don’t support range. Perhaps a regex might be better in this case?

5

A regex is better only because it is the only option. It needs multiple lines to do the same job as a range would.

Thank you.