Snort Regel I

• aktion protokoll srcip port -> destip port (optionen;)

• alert tcp any any -> $HOME_NET 143 (msg:"IMAP Bufferoverflow";flags: A+; \

• content:"|03cd 8031 db89 d840|"; resp: rst_all; reference:bugtraq,130; \

• reference:cve,CVE-1999-0005; classtype:attempted-admin; sid:1000003;)