[Snort-users] Snort rule firing on another port
arees734 at ...11827...
Thu Dec 13 13:27:10 EST 2012
Vrt have a rule 1:16606, it should fire on port 443 but its firing on 3801. there is one content match in the packet, but shouldnt it ignore the rule if the header does not meet the criteria??
All aspects of the rule look good, just wondering why it doesn't ignore the packets as the rule header doesn't match.
Sent from my iPhone
More information about the Snort-users