[Snort-sigs] Need Some Explanation about Sigs

SAM IDS sam_ids at ...144...
Mon Mar 29 02:32:14 EST 2004


Hello ,
 
About the Attack..
SID                   163 
Message           BACKDOOR WinCrash 1.0 Server Active 
Signature           alert tcp $HOME_NET 5714 -> $EXTERNAL_NET any (msg:"BACKDOOR WinCrash 1.0 Server Active" ; stateless; flags:SA,12; content:"|B4 B4|"; reference:arachnids,36; sid:163; classtype:misc-activity; rev:5;) 
 
i need to know 
1.what  12 means ??
2.what  rev means ??
 
thanx alot!!


---------------------------------
Do you Yahoo!?
Yahoo! Finance Tax Center - File online. File on time.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20040329/13349903/attachment.html>


More information about the Snort-sigs mailing list