[Snort-sigs] Correction to signature 1227
alexander.s at ...1565...
Mon Jun 9 16:55:02 EDT 2003
I hadn't looked which file it was in. I was going through the list of
rules that need documentation on snort.org. Sorry.
> -----Original Message-----
> From: Brian [mailto:bmc at ...95...]
> Sent: Monday, June 09, 2003 4:47 PM
> To: Steven Alexander
> Cc: snort-sigs at lists.sourceforge.net
> Subject: Re: [Snort-sigs] Correction to signature 1227
> On Mon, Jun 09, 2003 at 03:21:45PM -0700, Steven Alexander wrote:
> > SID 1227 is currently:
> > alert tcp $EXTERNAL_NET 6000:6005 -> $HOME_NET any
> (msg:"X11 outbound
> > client connection detected"; flow:established;
> > reference:arachnids,126; classtype:misc-activity; sid:1227; rev:5;)
> this rule is in deleted.rules for a reason. The rule sucks.
More information about the Snort-sigs