Actions
Bug #4399
closeduse keyword ‘offset’ that cause more alert
Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:
Description
The rules are as followsalert tcp any any -> any [445,135,139] (msg:"test";flow:from_client,established;content:"|FF||53||4d||42||A0|";sid:10001;rev:1;)
that just Alerted 1 times,but change ruler toalert tcp any any -> any [445,135,139] (msg:"test";flow:from_client,established;content:"|FF||53||4d||42||A0|";offset:4;depth:5;sid:10001;rev:1;)
that Alerted 7 times
Files
Actions