diff options
Diffstat (limited to 'rules/ntp-events.rules')
| -rw-r--r-- | rules/ntp-events.rules | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/rules/ntp-events.rules b/rules/ntp-events.rules new file mode 100644 index 0000000..fe70337 --- /dev/null +++ b/rules/ntp-events.rules @@ -0,0 +1,8 @@ +# NTP app layer event rules +# +# SID's fall in the 2222000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# +# These sigs fire at most once per connection. +# +alert ntp any any -> any any (msg:"SURICATA NTP malformed request data"; flow:to_server; app-layer-event:ntp.malformed_data; classtype:protocol-command-decode; sid:2222000; rev:1;) +alert ntp any any -> any any (msg:"SURICATA NTP malformed response data"; flow:to_client; app-layer-event:ntp.malformed_data; classtype:protocol-command-decode; sid:2222001; rev:1;) |