[Snort-sigs] Problem with icmp_seq

sofia insat sofia.insat at ...174...
Wed Nov 25 06:07:44 EST 2009


I have to verify with an hexadecimal icmp sequence that have this value "beef"
so I have written this rule :
alert icmp any any -> any any (msg:"----------- ICMPv6 : echo request -----------"; itype:128; content: "AAA"; icmp_seq: beef; sid:1000001;) 
but It does not detect a packet that have this icmp sequence

How can I resolve this problem


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20091125/a9044cb2/attachment.html>

More information about the Snort-sigs mailing list