[Snort-sigs] Bad reference on SID: 598?

Brian bmc at ...95...
Sun May 4 09:47:35 EDT 2003


On Sun, May 04, 2003 at 02:32:13AM -0400, JP Vossen wrote:
> Perhaps I'm missing something, but the reference for SID 598 [0] msg:"RPC
> portmap listing TCP 111" points to arachnids,429 [1] which talks about this:
> 	DS429 "PORTMAP-LISTING-32771"
> 	Platform(s):   solaris
> 	Category:   rpc
> 	This event indicates that a query was sent to the rpcbind/portmap
> daemon on a solaris machine, requesting port information for rpc services.
> 
> These do not seem to be the same thing.  Also, I got a few of these on an
> all RedHat (i.e. no Solaris) segment...

The reference should be arachnids,428.  

Thanks for pointing it out.

http://www.whitehats.com/info/IDS428

-brian




More information about the Snort-sigs mailing list