[Snort-sigs] Re: anyone have more detail other than window size of 55808 to craft a snort rule for this

James C. Slora Jr. Jim.Slora at ...1599...
Thu Jun 12 10:42:34 EDT 2003


> - no other options
***********************
Correction: 

Standard options:
MSS: 1460 (constant for primary source, variable for other sources)
NOP
WS: 2
NOP
NOP
SACKOK

One probe had these (one of the sources that had the aberrant Seq numbers):
MSS: 1380
NOP
NOP
NOP
NOP
NOP
NOP
SACKOK
*************************





More information about the Snort-sigs mailing list