# $Id: local.rules,v 1.5 2001/12/19 18:40:05 cazz Exp $
# ----------------
# LOCAL RULES
# ----------------
# This file intentionally does not come with signatures.  Put your local
# additions here.
#
alert tcp any any -> any 22 (stream_depth: strm_pkt_eq,20,0; msg:strm_pkt_eq;)
alert tcp any any -> any 22 (stream_depth: strm_pkt_gt,0,20; msg:strm_pkt_gt;)
alert tcp any any -> any 80 (stream_depth: strm_pkt_lt,5,0; msg:strm_pkt_lt;)
alert tcp any any -> any 22 (stream_depth: strm_pkt_lg,5,10; msg:strm_pkt_lg;)
alert tcp any any -> any 22 (stream_depth: strm_byte_gt,200,0; msg:strm_byte_gt;)
alert tcp any any -> any 22 (stream_depth: strm_byte_lt,200,0; msg:strm_byte_lt;)
alert tcp any any -> any 22 (stream_depth: strm_byte_lg,6,11; msg:strm_byte_lg;)