[Snort-sigs] Corrupted definitions of 2403.4 and 2404.5?

nnposter at ...592... nnposter at ...592...
Fri Jun 4 13:00:02 EDT 2004


Definitions of rules 2403.4 and 2404.5 start with two *relative* content
clauses:

flow:to_server,established; 
content:"|00 00|"; distance:0; 
content:"|00 00|"; distance:0; 
content:"|00|"; depth:1;
..........

Perhaps somebody fat-fingered the rules?




More information about the Snort-sigs mailing list