[Snort-sigs] False positive on "DDOS mstream handler to client"

Hi
 
I found a false positive for rule "classtype:attempted-dos; sid:248; rev:4;"=
.  The trigger was an RTP packet that uses random high ports which happend t=
o be 12754.  Since the RTP data is pretty much random as well it also contai=
ned the string ">". 
 
Payload of my packet:
length =3D 30

000 : 03 00 00 1E 22 C0 00 02 04 80 13 4C 00 C3 26 1C   ...."......L..&.
010 : FA 40 3E 00 C3 26 1C FA 40 3F 03 00 01 00         .@>..&..@?....
As stated this was from a Cisco Voip gateway to a software call agent.
Kind Regards
Christiaan Ehlers

Disclaimer=0A=
=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A=
=0A=
This email and any files transmitted with it are confidential and=0A=
intended solely for the use of the individual or entity to whom they=0A=
are addressed. If you have received this email in error please notify=0A=
the system manager. Please note that any views or opinions presented=0A=
in this email are solely those of the author and do not necessarily=0A=
represent those of the company. Finally, the recipient should check=0A=
this email and any attachments for the presence of viruses. The=0A=
company accepts no liability for any damage caused by any virus=0A=
transmitted by this email.=0A=
=0A=
=0A=
Inclarity Ltd.=0A=
=0A=
Registered Office: Olympic Office Centre, Fulton Road, Wembley, =0A=
Middlesex, HA9 0NU=0A=
Telephone: + 44 (0)845 698 0800=0A=
Fax: + 44 (0)845 698 1000=0A=
=0A=
Registered Company No. 02673204=0A=
=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs