Re: [Snort-sigs] Need Some Explanation about Sigs

From: Brian <bmc(at)snort.org>
Date: Mon Mar 29 2004 - 13:22:25 EST

On Mon, Mar 29, 2004 at 01:48:32PM -0300, Alejandro Flores wrote:
> > Signature
> > alert tcp $HOME_NET 5714 -> $EXTERNAL_NET any (msg:"BACKDOOR

No it doesn't. It means, check that only the SA bits are set, ignoring the reserved bits 1 & 2.

Brian

---

This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Mon Mar 29 13:36:21 2004