[Snort-sigs] FP: sid: 469 - ICMP PING NMAP

I have noticed a false pos from Win2k PCs talking to MS Active Directory
Servers. Below is the missing template information.

# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others.  References in the rules themselves
# should be used for linking to other's work.
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
#
# $Id$
#
#

Rule:  ICMP PING NMAP

--
Sid:    469

--
Summary:

--
Impact:

--
Detailed Information:

--
Affected Systems:

--
Attack Scenarios:

--
Ease of Attack:

--
False Positives:        Workstations communicating with Microsoft Active
Directory Servers will cause false positives for this sid.

--
False Negatives:

--
Corrective Action:

--
Contributors:   jynx@icurnet.com

--
Additional References:


jynx



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs