""ET DOS Likely NTP DDoS In Progress MON_LIST Response to Non-Ephemeral Port IMPL 0x03""

SID: 2017966

Revision: 3

Class Type: attempted-dos

Metadata: created_at 2014_01_14, updated_at 2014_12_05

Reference:

• Link

Protocol: udp

Source Network: any

Source Port: 123

Destination Network: any

Destination Port: 0:1023

Flow:

Contents:

• Value: "|00 03 2a|" Depth: 3 Offset: 1

Within:

PCRE:

Special Options:

source