[Snort-sigs] flowbits: netsenum

Joel Esler jesler at ...435...
Thu May 30 07:01:01 EDT 2013


On May 29, 2013, at 7:53 PM, waldo kitty <wkitty42 at ...3507...> wrote:

>>> additionally, both existing rules' MSG are identical... one should speak of "to
>>> client" and the other "to server" in the MSG for clarity??
>> 
>> The "set" rule is noalert. You'll never see it alert.
> 
> true but perhaps someone sets them to show an alert? ;)

Is that something you do?  I'm not asking that to be a smartass, I'm asking if that's actually a use case that I haven't studied. 



More information about the Snort-sigs mailing list