[Snort-sigs] dupes left

Kreimendahl, Chad J Chad.Kreimendahl at ...361...
Fri May 31 09:04:05 EDT 2002


 
looks like 1 established,established left.
 
tcp $EXTERNAL_NET 6000:6005 -> $HOME_NET any (msg:"X11 outbound client
connection detected"; flow:established,established; reference:arachnids,126;
classtype:misc-activity; sid:1227; rev:3;)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20020531/6e8735d3/attachment.html>


More information about the Snort-sigs mailing list