[Snort-users] Snort Rule Duplicate

Ralf Hildebrandt Ralf.Hildebrandt at ...821...
Mon Mar 26 02:17:23 EST 2001


Once more, a duplicate (a triplicate?):

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC whisker head";flags: A+; content:"HEAD/./";)  (from web-misc.rules)

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC whisker head"; dsize: > 512; flags:A+; content:"|68 65 61 64|"; offset: 0; depth: 4;)  (from web-misc.rules)

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC whisker head"; content:"HEAD"; offset: 0; depth: 4; nocase; dsize:>512; flags:A+;) (from web-misc.rules)
-- 
ralf.hildebrandt at ...821...                            innominate AG
System Engineer                        Don't be afraid of what you see -
Diplom-Informatiker                     be afraid of what you don't see!
tel: +49.(0)7000.POSTFIX  fax: +49.(0)30.308806-698         





More information about the Snort-users mailing list