[Snort-sigs] change to sid 2189 (PIM) to account for MCAST-NET

Jon Hart warchild at ...288...
Sat Aug 23 19:38:06 EDT 2003


On Sat, Aug 23, 2003 at 09:48:44PM -0400, Jon Hart wrote:
<snip>

> alert ip any any -> !MULTICAST_NET any (msg:"BAD-TRAFFIC IP Proto 103 (PIM)";
> ip_proto:103; reference:bugtraq,8211; reference:cve,CAN-2003-0567;
> classtype:non-standard-protocol; sid:2189; rev:2;)

Sorry, that should have read:

alert ip any any -> !$MULTICAST_NET any (msg:"BAD-TRAFFIC IP Proto 103
(PIM)"; ip_proto:103; reference:bugtraq,8211;
reference:cve,CAN-2003-0567; classtype:non-standard-protocol; sid:2189;
rev:2;)

I omitted the '$' before MULTICAST_NET in my email.  No, that error is
not present in my rules ;).

-jon




More information about the Snort-sigs mailing list