[Snort-sigs] Bad reference on SID: 598?
bmc at ...95...
Sun May 4 09:47:35 EDT 2003
On Sun, May 04, 2003 at 02:32:13AM -0400, JP Vossen wrote:
> Perhaps I'm missing something, but the reference for SID 598  msg:"RPC
> portmap listing TCP 111" points to arachnids,429  which talks about this:
> DS429 "PORTMAP-LISTING-32771"
> Platform(s): solaris
> Category: rpc
> This event indicates that a query was sent to the rpcbind/portmap
> daemon on a solaris machine, requesting port information for rpc services.
> These do not seem to be the same thing. Also, I got a few of these on an
> all RedHat (i.e. no Solaris) segment...
The reference should be arachnids,428.
Thanks for pointing it out.
More information about the Snort-sigs