?? wishlist
字號:
$Id: WISHLIST,v 1.2 2002/05/28 18:01:24 cazz Exp $SIGNATURES ----* UDP & ICMP flow. (Client = first person to talk?)* Distance from begining of the stream* Distance between CONTENT and to NEWLINE* IP Ranges* Port ranges* SRC & DST ports not required for signatures of protocols that don't have ports PLUGINS----* unified IP formats (IPs are specified in the same way for every plugin)* Better portscan detection* coffee plugin. (Over $X high priority alarms during off hours = make big pot of coffee)* all plugin alerts contain the following configurations - priority - classtype - references - host ranges (IP ranges, just like rules) - port ranges (port ranges, just like rules)PROTOCOLS----* email parsing (i.e. flagging on an attachment name)* HTTP CGI Variables (GET & POST)* HTTP/1.1 decodesGENERAL----* method to reload signatures without killing state engine* self healing (dropping lots of packets? drop lower priority signatures)* regular statistic dumps* better access to protocol stats (I.e. 70% TCP, 20% UDP, 10% ICMP)* better access to port stats (I.e. 70% 80 , 20% 25, 10% 22)* multithreading * thresholds for all alerts (signatures & plugins) - X sid:313 alerts from Y hosts in Z seconds - X tcp overlap alerts from the same host in Y seconds
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -