""ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x02""

SID: 2017918

Revision: 2

Class Type: attempted-dos

Metadata: created_at 2014_01_03, updated_at 2014_01_03

Reference:

• Link

Protocol: udp

Source Network: any

Source Port: any

Destination Network: any

Destination Port: 123

Flow:

Contents:

• Value: "|00 02 2A|" Depth: 3 Offset: 1

Within:

PCRE:

Special Options:

source