[Snort-users] flags SYN question...
bmc at ...950...
Fri Dec 5 07:46:01 EST 2003
On Thu, Dec 04, 2003 at 09:58:03AM -0800, gfyspf at ...131... wrote:
> Could someone please tell me what the 12 stands for in the following
> flags:S,12 and are there other numbers if so what are they used for?
> I have been searching all the documentation and can't find much info
> on it.
The detection option "flags:S,12;" means, look for just the syn flag,
ignoring the first and second reserved bit.
More information about the Snort-users