[Dshield] Sobig watch

John Sage jsage at finchhaven.com
Sat Aug 23 14:08:31 GMT 2003


grr..

On Sat, Aug 23, 2003 at 06:36:24AM -0700, John Sage wrote:
<snip>
> #
> alert udp $EXTERNAL_NET any -> $HOME_NET 995:999 \
>   (msg:"UDP inbound to 995:999";)
> #
<snip>

The colon : in the (msg: "UDP...";) between 995:999 won't work.

It's gotta be a hyphen: 995-999


- John
-- 
"Warning: time of day goes back, taking countermeasures."




More information about the list mailing list