[Snort-users] Terminal services signature

Tony Wong tony.wong at ...5535...
Wed Jul 24 11:44:02 EDT 2002


How do I create a rule to alert terminal service access

Alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"Terminal Services
access"; ......


... Then I don't know what to put in between ()


Thanks





More information about the Snort-users mailing list