[Snort-sigs] Mistake in SID 379

Steven Alexander alexander.s at ...1565...
Mon Jun 9 09:42:06 EDT 2003


alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Pinger
Windows"; content:"|44617461000000000000000000000000|"; itype:8;
depth:32; reference:arachnids,163; sid:379; classtype:misc-activity;
rev:4;) 

It appears that the above rule should reference arachnids 165 not 163.

-steven alexander




More information about the Snort-sigs mailing list