[Snort-sigs] Need Some Explanation about Sigs

Brian bmc at ...95...
Mon Mar 29 10:24:07 EST 2004


On Mon, Mar 29, 2004 at 01:48:32PM -0300, Alejandro Flores wrote:
> > Signature 
> > alert tcp $HOME_NET 5714 -> $EXTERNAL_NET any (msg:"BACKDOOR
> > +WinCrash 1.0 Server Active" ; stateless; flags:SA,12;
> > content:"|B4 B4|"; +reference:arachnids,36; sid:163;
> > classtype:misc-activity; rev:5;)
> >
> > i need to know 
> > 1.what  12 means ??
> 
> 	reserved bits 1,2 set.

No it doesn't.  It means, check that only the SA bits are set,
ignoring the reserved bits 1 & 2.

Brian




More information about the Snort-sigs mailing list