Re: [Snort-sigs] tftp rules classtypes confusing

"Miller, Eoin" <Miller@fhlb-of.com> writes:

> now what seems to be odd is that the classtype is

The direction the rule was originally written for was as a way to detect with snort when people successfuly compromised machine where tftp is one of the common upload mechanisms for toolsets.

-- 
Chris Green 
 "Not everyone holds these truths to be self-evident, so we've worked
                  up a proof of them as Appendix A." --  Paul Prescod


-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger 
for complex code. Debugging C/C++ programs can leave you feeling lost and 
disoriented. TotalView can help you find your way. Available on major UNIX 
and Linux platforms. Try it free. www.etnus.com
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs