[Snort-devel] a doozie of a metaphysical question

tlewis at ...255... tlewis at ...255...
Tue Jun 12 22:35:05 EDT 2001


If you see a UDP packet with a source port of 123 (NTP) and a destination
port of 53 (DNS), then what protocol should you assume is used in that
packet?  If one were elbow-deep in building a next-generation intrusion
detection system with automatic protocol decomposition, then this sort
of question could be very important to one's quest...

--
Todd Lewis
tlewis at ...255...





More information about the Snort-devel mailing list