[Snort-sigs] Correction to signature 1227

Brian bmc at ...95...
Mon Jun 9 16:48:04 EDT 2003


On Mon, Jun 09, 2003 at 03:21:45PM -0700, Steven Alexander wrote:
> SID 1227 is currently:
> 
> alert tcp $EXTERNAL_NET 6000:6005 -> $HOME_NET any (msg:"X11 outbound
> client connection detected"; flow:established; reference:arachnids,126;
> classtype:misc-activity; sid:1227; rev:5;) 

this rule is in deleted.rules for a reason.  The rule sucks.

-brian




More information about the Snort-sigs mailing list