[Snort-sigs] Traceroute test

Brian bmc at ...95...
Tue Jun 17 10:27:28 EDT 2003


On Tue, Jun 17, 2003 at 12:28:40PM -0400, Esler, Joel  Contractor wrote:
> I Think there is a way, however, refresh my memory...
> 
> Since traceroute starts on port 33435 udp...  We can write a rule to detect
> traceroutes...

Uh...

Or you could use ttl:1;

-brian




More information about the Snort-sigs mailing list