Code Red Rule

[Richard Parker <snort () expressive ltd uk>]

Hi,

I'm relatively new to snort, could someone comment on this rule for
catching Code Red?

alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"Code Red default.ida
attempt"; flags:PA; content:"GET /default.ida"; nocase;) 

Is that right?

TIA

Rich

-- 
Richard Parker, Expressive Limited

Don't try this at home. Do it at a friend's. It's much safer there.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users