[Snort-sigs] flowbits: netsenum

Joel Esler jesler at ...435...
Wed May 29 11:23:19 EDT 2013


On May 29, 2013, at 10:57 AM, waldo kitty <wkitty42 at ...3507...> wrote:

> there is no check rule in the *.rules files for flowbits: netsenum…
> 
It's checked in 24007.


> additionally, both existing rules' MSG are identical... one should speak of "to 
> client" and the other "to server" in the MSG for clarity??

The "set" rule is noalert.  You'll never see it alert.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20130529/bb8f7539/attachment.html>


More information about the Snort-sigs mailing list