No subject

Thu Nov 23 16:34:03 EST 2017

targeted may turn out to be an important data point. Someone
might even want to ignore the 445 rule if he has only NT4
machines in a certain network, and doesn't care about
non-NT4 attacks. In that light, I'd want to differentiate
between the alert messages to reflect the port.

Tod Beardsley (GCIA, MCSE)
"It's okay to yell fire in a crowded theater
if the theater is actually on fire."

More information about the Snort-sigs mailing list