[Snort-users] File.swf.cff has 2 sections for flowbits?

Gerry Carpinetti carpinetti.gerry at outlook.com
Wed Jun 13 21:29:17 EDT 2018


I have noticed some have flowbits in 2 different sections of a single line of code for example:
Flowbits:isset, file.swf; and again flowbits:set, file.swf.cff which is the Warning is set but not ever checked.

So how are you going to handle one of these that has flowbits mentioned twice in a single line and some have matching SID’s. So the question is which one are you suppose to modify when a line has 2 sections for flowbits???

Thank You,
Gerry Carpinetti
US Army Vet
BIT-Information Assurance and Security
TestOut Cert’s - Network and Security Pro
Currently obtaining CEH

Get Outlook for iOS<https://aka.ms/o0ukef>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20180614/464bdc92/attachment.html>


More information about the Snort-users mailing list