Snort mailing list archives

BackDoor Subsevsen


From: "Biswas, Proneet" <pbiswas () iPolicyNet COM>
Date: Thu, 1 Jan 2004 22:32:09 -0800

Hi,
  I was trying to analyze the signature for SID : 103
  BackDoor Subseven 22

  From Packet Direction "-> ", it appears that the signature is on a packet
from port 27374 to any port inside
  But from flow direction "to_server", it would appear that the signature is
to be triggered for a packet from any port to port 27374 assuming that the
port 27374 is the server port. 

Can you please point me out if I am missing anything on this ?

Thanks.

Current thread: