[Snort-sigs] maybe I'll use a subject this time

Kreimendahl, Chad J Chad.Kreimendahl at ...361...
Mon Mar 25 09:00:11 EST 2002

alert tcp $HOME_NET 513 -> $EXTERNAL_NET any (msg:"RSERVICES rlogin login
failure"; flags:A+; flow:from_server;; content:"login incorrect";
reference:arachnids,393; classtype:unsuccessful-user; sid:605; rev:4;)

the two semi-colons in this rule... problem? no?  seems to be the only rule
with this 'feature'. :)

More information about the Snort-sigs mailing list