Re: [firestorm054] pb with 'bad traffic syn to multicast address'on fbsd48 (not on linux)

[rmkml <rmkml@xxxxxxxxxx>]

test# cd /var/lib/firestorm/snort-rules/
test# grep 'BAD TRAFFIC syn ' *
bad-traffic.rules:alert tcp any any -> [232.0.0.0/8,233.0.0.0/8,239.0.0.0/8]
any (msg:"BAD TRAFFIC syn to multicast address"; flags:S+;
classtype:bad-unknown; sid:1431; rev:4;)

Thanks

Regards.

Franck




Gianni Tedesco wrote:

> On Thu, 2003-09-25 at 14:23, rmkml wrote:
> > Hi All,
> >
> > I tested new release 054 of firestorm,
> >
> > and I have a pb.
>
> Thanks.
>
> Can you paste this rule 'BAD TRAFFIC syn to multicast address' from your
> ruleset pls?
>
> --
> // Gianni Tedesco (gianni at scaramanga dot co dot uk)
> lynx --source www.scaramanga.co.uk/gianni-at-ecsc.asc | gpg --import
> 8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D
>
>   ------------------------------------------------------------------------
>                        Name: signature.asc
>    signature.asc       Type: application/pgp-signature
>                 Description: This is a digitally signed message part