[Snort-sigs] SID 520

Paul Cardon paul at ...353...
Fri Feb 8 08:13:24 EST 2002


Warchild wrote:

 > Rule:
 > alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"TFTP root
 > directory"; content:"|0001|/"; reference:arachnids,138;
 >  reference:cve,CVE-1999-0183; classtype:bad-unknown; sid:520; rev:2;)

How about adding depth:3 ?

-paul





More information about the Snort-sigs mailing list