[Snort-users] flags SYN question...

Brian bmc at ...950...
Fri Dec 5 07:46:01 EST 2003


On Thu, Dec 04, 2003 at 09:58:03AM -0800, gfyspf at ...131... wrote:
> Could someone please tell me what the 12 stands for in the following
> line:
> 
> flags:S,12  and are there other numbers if so what are they used for?
> I have been searching all the documentation and can't find much info
> on it.  

The detection option "flags:S,12;" means, look for just the syn flag,
ignoring the first and second reserved bit.

Brian




More information about the Snort-users mailing list