[Snort-sigs] Correction to signature 1227

Steven Alexander alexander.s at ...1565...
Mon Jun 9 16:55:02 EDT 2003


I hadn't looked which file it was in.  I was going through the list of
rules that need documentation on snort.org.  Sorry.

-steven

> -----Original Message-----
> From: Brian [mailto:bmc at ...95...] 
> Sent: Monday, June 09, 2003 4:47 PM
> To: Steven Alexander
> Cc: snort-sigs at lists.sourceforge.net
> Subject: Re: [Snort-sigs] Correction to signature 1227
> 
> 
> On Mon, Jun 09, 2003 at 03:21:45PM -0700, Steven Alexander wrote:
> > SID 1227 is currently:
> > 
> > alert tcp $EXTERNAL_NET 6000:6005 -> $HOME_NET any 
> (msg:"X11 outbound 
> > client connection detected"; flow:established; 
> > reference:arachnids,126; classtype:misc-activity; sid:1227; rev:5;)
> 
> this rule is in deleted.rules for a reason.  The rule sucks.
> 
> -brian
> 




More information about the Snort-sigs mailing list