[Snort-sigs] Broken thresholding in 2923.1 and 2924.1?

Rule: NETBIOS SMB repeated logon failure
Rule: NETBIOS SMB-DS repeated logon failure

--
Sid: 2923, 2924

--
Rules 2923.1 and 2924.1 are monitoring failed login server responses 
so it seems to me that they should be thresholding on destination, not 
source:

alert tcp $HOME_NET 139 -> $EXTERNAL_NET any 
(msg:"NETBIOS SMB repeated logon failure"; 
flow:from_server,established; 
content:"|ff|SMB"; offset:4; depth:4; 
content:"|73|"; distance:0; within:1; 
content:"|6d0000c0|"; distance:0; within:4; 
threshold:type threshold,track by_dst,count 10,seconds 60; 
classtype:unsuccessful-user; sid:2923; rev:2;) 

alert tcp $HOME_NET 445 -> $EXTERNAL_NET any 
(msg:"NETBIOS SMB-DS repeated logon failure"; 
flow:from_server,established; 
content:"|ff|SMB"; offset:4; depth:4; 
content:"|73|"; distance:0; within:1; 
content:"|6d0000c0|"; distance:0; within:4; 
threshold:type threshold,track by_dst,count 10,seconds 60; 
classtype:unsuccessful-user; sid:2924; rev:2;) 


Or is the intent of these two rules to track distributed cracking?


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs