ping-lib

网络安全入侵检测系统原码

# $Id: ping-lib,v 1.2 2000/11/18 08:25:04 roesch Exp $

alert icmp any any -> $HOME_NET any (msg:"IDS166 - PING Seer Windows"; content:"|88042020202020202020202020202020|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS152 - PING BSD"; content: "|08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17|"; itype: 8; depth: 32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS153 - PING Cisco Type.x"; content:"|abcdabcdabcdabcdabcdabcdabcdabcd|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS154 - PING CyberKit 2.2 Windows"; content:"|aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS155 - PING Delphi-Piette Windows"; content:"|50696e67696e672066726f6d2044656c|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS156 - PING Flowpoint 2200DSL Router"; content:"|0102 0304 0506 0708 090a 0b0c 0d0e 0f10|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS157 - PING IP NetMonitor Macintosh"; content:"|a9205375737461696e61626c6520536f|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS158 - PING ISS Pinger"; content:"|495353504e475251|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS159 - PING Microsoft Windows"; content:"|6162636465666768696a6b6c6d6e6f70|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS161 - PING Network Toolbox 3 Windows"; content:"|3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS162 - PING Nmap2.36BETA";itype:8;dsize:0;) 
alert icmp any any -> $HOME_NET any (msg:"PING *NIX Type"; content:"|101112131415161718191a1b1c1d1e1f|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS151 - PING BeOS4.x"; content:"|00000000000000000000000008090a0b|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS164 - PING Ping-O-MeterWindows"; content:"|4f4d 6574 6572 4f62 6573 6541 726d 6164|";itype:8;depth:32;) 
alert icmp any any <> $HOME_NET any (msg:"ICMP Message"; itype:18;) 
alert icmp any any -> $HOME_NET any (msg:"IDS167 - PING TJPingPro1.1Build 2 Windows"; content:"|544a 5069 6e67 5072 6f20 6279 204a 696d|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS168 - PING WhatsupGold Windows"; content:"|5768 6174 7355 7020 2d20 4120 4e65 7477|";itype:8;depth:32;) 
alert icmp any any -> $HOME_NET any (msg:"IDS169 - PING Windows Type"; content: "|61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70|"; itype: 8; depth: 32;) 
alert tcp any any -> $HOME_NET any (msg:"IDS028 - PING NMAP TCP";flags:A;ack:0;) 
alert icmp any any <> $HOME_NET any (msg:"ICMP Destination Unreachable"; itype:3;) 
alert icmp any any <> $HOME_NET any (msg:"ICMP Source Quench"; itype:4;) 
alert icmp any any <> $HOME_NET any (msg:"ICMP Time Exceeded"; itype:11;) 
alert icmp any any <> $HOME_NET any (msg:"ICMP Parameter Problem"; itype:12;) 
alert icmp any any <> $HOME_NET any (msg:"ICMP Timestamp"; itype:13;) 
alert icmp any any <> $HOME_NET any (msg:"ICMP Information Request"; itype:15;) 
alert icmp any any <> $HOME_NET any (msg:"ICMP Information Reply"; itype:16;) 
alert icmp any any <> $HOME_NET any (msg:"IDS216 - ICMP Subnet Mask Request"; itype:17;) 
alert icmp any any -> $HOME_NET any (msg:"IDS163 - PING Pinger Windows"; content:"|44617461000000000000000000000000|";itype:8;depth:32;)