""ET DOS DNS Amplification Attack Inbound""
SID: 2016016
Revision: 8
Class Type: bad-unknown
Metadata: created_at 2012_12_12, updated_at 2014_10_01
Reference:
Protocol: udp
Source Network: any
Source Port: any
Destination Network: $HOME_NET
Destination Port: 53
Flow:
Contents:
-
Value: "|01 00 00 01 00 00 00 00 00 01|" Depth: 10 Offset: 2
-
Value: "|00 ff 00 01 00 00 29|"
Within: 7
PCRE: "/^[^\x00]+?\x00/R"
Special Options:
- fast_pattern