[Snort-users] Just FYI

Ralf Hildebrandt Ralf.Hildebrandt at ...821...
Mon Mar 5 06:41:05 EST 2001


On Fri, Mar 02, 2001 at 03:55:59PM +0100, Ralf Hildebrandt wrote:

> Some stuff:
> 
> * Many rules with ":1023" are falsely labeled as "< 1023"; must be "< 1024" or
>   "<= 1023"
> 
> * The rule "MISC source port 53 to <1024" has the same text for both UDP and
>   TCP; I propose "MISC source port 53 to <1024 (UDP)" and "MISC source port
>   53 to <1024 (UDP)"

Some more:

* The Wingate rule is duplicated; one with port 1080 and once with both 1080
  and 8080 as destination port

-- 
ralf.hildebrandt at ...821...
System Engineer                                            innominate AG
Diplom-Informatiker                                 the linux architects
tel: +49.30.308806-62  fax: -698                      www.innominate.com




More information about the Snort-users mailing list