From df10559d80dab7320d9df07246261396334158cb Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 13 Feb 2014 14:41:54 +0100 Subject: [PATCH] dns: fix message of decoder rule 2240008 The message now reflects that the rule matches on: app-layer-event:dns.state_memcap_reached; --- rules/dns-events.rules | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/dns-events.rules b/rules/dns-events.rules index 95dee1d09b..693f2f1b3b 100644 --- a/rules/dns-events.rules +++ b/rules/dns-events.rules @@ -12,4 +12,4 @@ alert dns any any -> any any (msg:"SURICATA DNS Z flag set"; app-layer-event:dns # Request Flood Detected alert dns any any -> any any (msg:"SURICATA DNS request flood detected"; flow:to_server; app-layer-event:dns.flooded; sid:2240007; rev:1;) # Per-flow (state) memcap reached. Relates to the app-layer.protocols.dns.state-memcap setting. -alert dns any any -> any any (msg:"SURICATA DNS request flood detected"; flow:to_server; app-layer-event:dns.state_memcap_reached; sid:2240008; rev:1;) +alert dns any any -> any any (msg:"SURICATA DNS flow memcap reached"; flow:to_server; app-layer-event:dns.state_memcap_reached; sid:2240008; rev:2;)