[Snort-sigs] False negatives on 1:491:6 (INFO FTP Bad login)

Brian bmc at ...95...
Tue Jul 6 08:07:07 EDT 2004


On Mon, May 10, 2004 at 10:38:43AM -0600, nnposter at ...592... wrote:
> 
> alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"INFO FTP Bad login";
> content:"530 "; pcre:"/^530\s+(Login|User)\s/smi";
> flow:from_server,established; classtype:bad-unknown; sid:491; rev:7;)

this went in a while ago, but responding to to make sure I clean up my
queue




More information about the Snort-sigs mailing list