[Snort-users] New Ruleset

Ralf Hildebrandt Ralf.Hildebrandt at ...821...
Fri Mar 30 04:27:04 EST 2001


On Fri, Mar 30, 2001 at 03:57:31PM +0900, HABU Takuya wrote:

> 1) In "misc.rules" file of March 1st,
> there were 3 rules like that:
> alert tcp $EXTERNAL_NET 20 -> $HOME_NET :1023 (msg:"MISC Source Port 20 to
> <1024"; flags:S; reference:arachnids,06;)
> and once the port number ":1023" had changed to ":1024"
> at 15th. However, the latast rule shows ":1023" again.
> Which rules are really correct?

:1023 should be correct.

-- 
ralf.hildebrandt at ...821...                            innominate AG
System Engineer                        Don't be afraid of what you see -
Diplom-Informatiker                     be afraid of what you don't see!
tel: +49.(0)7000.POSTFIX  fax: +49.(0)30.308806-698         





More information about the Snort-users mailing list