[Snort-sigs] flowbits: netsenum

Joel Esler jesler at ...435...
Wed May 29 11:23:19 EDT 2013

On May 29, 2013, at 10:57 AM, waldo kitty <wkitty42 at ...3507...> wrote:

> there is no check rule in the *.rules files for flowbits: netsenum…
It's checked in 24007.

> additionally, both existing rules' MSG are identical... one should speak of "to 
> client" and the other "to server" in the MSG for clarity??

The "set" rule is noalert.  You'll never see it alert.

Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20130529/bb8f7539/attachment.html>

More information about the Snort-sigs mailing list