[Snort-sigs] Need Some Explanation about Sigs

From: SAM IDS <sam_ids(at)yahoo.com>
Date: Mon Mar 29 2004 - 05:31:21 EST

Hello ,  

About the Attack..

SID                   163 
Message           BACKDOOR WinCrash 1.0 Server Active 
Signature           alert tcp $HOME_NET 5714 -> $EXTERNAL_NET any (msg:"BACKDOOR WinCrash 1.0 Server Active" ; stateless; flags:SA,12; content:"|B4 B4|"; reference:arachnids,36; sid:163; classtype:misc-activity; rev:5;) 
 

i need to know
1.what 12 means ??
2.what rev means ??  

thanx alot!!

---

Do you Yahoo!?
Yahoo! Finance Tax Center - File online. File on time.

---

This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Mon Mar 29 06:14:20 2004