[Snort-sigs] flowbits: netsenum
jesler at ...435...
Thu May 30 07:01:01 EDT 2013
On May 29, 2013, at 7:53 PM, waldo kitty <wkitty42 at ...3507...> wrote:
>>> additionally, both existing rules' MSG are identical... one should speak of "to
>>> client" and the other "to server" in the MSG for clarity??
>> The "set" rule is noalert. You'll never see it alert.
> true but perhaps someone sets them to show an alert? ;)
Is that something you do? I'm not asking that to be a smartass, I'm asking if that's actually a use case that I haven't studied.
More information about the Snort-sigs