Need help creating signature for anonymous ftp logins
I am trying to alert after 3 anonymous logins. I have it working with only 1 login, but as soon as I change it to alert after 3 it doesn't see it. At the moment I have a custom string.tcp signature with all the defaults except the number of minhits was changed to three. I've experimented with several changes, but it still doesn't work. Anyone know what I am missing?
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...