""ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x03""

SID: 2017921

Revision: 2

Class Type: attempted-dos

Metadata: created_at 2014_01_03, updated_at 2014_01_03

Reference:

• Link

Protocol: udp

Source Network: $HOME_NET

Source Port: 123

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow:

Contents:

• Value: "|00 03 2a|" Depth: 3 Offset: 1

Within:

PCRE:

Special Options:

source