[Snort-users] Check for NO TCP Flags set?

Chris Green cmg at ...1935...
Fri May 9 13:02:20 EDT 2003


"Sheahan, Paul" <Paul.Sheahan at ...2218...> writes:

> I know I can check for flags set using Flags:S for example. Though I was
> curious if there is a way to check for NO flags being set?. I read that this
> may be seen in illicit servers.

flags: 0 should work.
-- 
Chris Green <cmg at ...1935...>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx




More information about the Snort-users mailing list