Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[SONICWALL] IP Spoof Detected"; content: "IP Spoof Detected"; default_proto: tcp; parse_src_ip: 2; parse_dst_ip: 3; normalize; classtype:suspicious-traffic; sid:5012101; rev:1;)Field Validations
Loading…
Comments (0)
Loading comments...