[Snort-users] Rule for established Telnet/SSH

James the_saint_james at ...131...
Wed Oct 24 22:54:06 EDT 2001

How would I write a rule for external to internal ssh/telnet sessions the
are established (syn-ack-syn) ? We allow very little telnet from outside and
I want to watch this. I've already written rules for attempts to connect
this way.


Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

More information about the Snort-users mailing list