[Emerging-Sigs] FP 2404017 (botcc)

[Jack Pepper]

Sorry for the Typo:
>
> How about this:
> pass udp 85.214.36.108 123 <> any 123 (msg: "no alert on ntp at this
> addr"; sid: 1404017; rev:1);

should be :
pass udp 85.214.36.108 123 <> any 123 (msg: "no alert on ntp at this  
addr"; sid: 1404017; rev:1;)


-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com