Re: [RFC patch prelude-lml] Add Deep Packet Inspection support for NetScreen v1

Hi Jerome,


Le vendredi 31 octobre 2008 à 22:40 +0100, Jerome Benoit a écrit :
> Add Deep Packet Inspection alert support to prelude-lml ruleset for NetScreen.

Thanks for the contribution!

> Any comments are welcome. 

The rule look mostly fine, but the classification.text is cryptic. 

A good solution would be to normalize this entry, and set it depending
on what is being matched. You can have a look at the ModSecurity ruleset
for an example on how to do that.

Keep up the good work!

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)9 50 70 21 58                  Fax: +33(0)9 57 25 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel