[Snort-sigs] new rule for detect Radware Linkproof Proximity packet

rmkml rmkml at ...324...
Sat Dec 3 06:09:01 EST 2005


Hi,

please check and maybe add this new rule :

misc.rules:alert udp $EXTERNAL_NET 1023: -> $HOME_NET 1023: (msg:"MISC 
Radware Linkproof detect"; dsize:50; content:"linkproof.proximity.advanced"; classtype:attempted-dos; )

Improve/comments are welcome.

Regards
Rmkml




More information about the Snort-sigs mailing list