(no subject)

["C Boss" <cboss99 () hotmail com>]

Hello,

The following rule:

alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP RCPT TO overflow"; 
flags:A+; content:"rcpt to|3a|"; dsize:>800; reference:cve,CAN-2001-0260; 
reference:bugtraq,2283; classtype:attempted-admin; sid:654; rev:1;)

is it looking at the data size of the SMTP "content" field or the size of 
the payload ?

Thanks.

_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users