[Snort-sigs] Missing SID information on Snort site

MA Bel mab_generic at ...3751...
Wed May 8 14:14:03 EDT 2013


Hi,
The following rule was triggered by Snort. The corresponding SID number is 20437. I did a search on the Snort website, no results were returned. This happens from time to time with other SIDs.   Does anyone know why the information is missing from the Snort website?
alert tcp $EXTERNAL_NET any -> $HOME_NET [443,465,587,995,993] (msg:"MALWARE-TOOLS multiple TLSv1 Encrypted Handshake messages - THC-SSL tool, potential DoS"; flow:established,to_server; ssl_state:!client_hello; content:"|16 03 01|"; depth:3; detection_filter:track by_src,count 25, seconds 2; reference:url,www.thc.org/thc-ssl-dos/; classtype:attempted-dos; sid:20437; rev:2;)
/mab 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20130508/7bf9e3e9/attachment.html>


More information about the Snort-sigs mailing list