[Snort-sigs] Bad reference on SID: 598?

JP Vossen vossenjp at ...1431...
Sat May 3 23:33:07 EDT 2003


Perhaps I'm missing something, but the reference for SID 598 [0] msg:"RPC
portmap listing TCP 111" points to arachnids,429 [1] which talks about this:
	DS429 "PORTMAP-LISTING-32771"
	Platform(s):   solaris
	Category:   rpc
	This event indicates that a query was sent to the rpcbind/portmap
daemon on a solaris machine, requesting port information for rpc services.

These do not seem to be the same thing.  Also, I got a few of these on an
all RedHat (i.e. no Solaris) segment...


Just wondering,
JP

[0] http://www.snort.org/snort-db/sid.html?sid=598
[1] http://www.whitehats.com/cgi/arachNIDS/Show?_id=ids429&view=event

------------------------------|:::======|--------------------------------
JP Vossen, CISSP              |:::======|                jp at ...1432...
My Account, My Opinions       |=========|       http://www.jpsdomain.org/
------------------------------|=========|--------------------------------
"The software said it requires Windows 98 or better, so I installed
Linux..."





More information about the Snort-sigs mailing list