Rule-4: alert udp $EXTERNAL_NET any -> $HOME_NET 3333 (msg:"ET EXPLOIT Wireshark ENTTEC DMX Data Processing Code Execution Attempt 1";

content:"|45 53 44 44|";


content:"|04|"; distance:2; within:1; content:"|FE FF|";

distance:0; within:50; content:"|FE FF|"; distance:0; within:50; content:"|FE|"; byte_test:1,>,11,0,relative; classtype:attempted-user; reference:url,www.exploitdb. com/exploits/15898/; reference:bid,45634; sid:2012154; rev:2;)

closed as unclear what you're asking by Mark, Xander, AJ Henderson, Steve, Iszi Jul 7 '14 at 20:33

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


The rule appears to look for a specific pattern of content bytes in traffic sent to port 3333/UDP.

The goal appears to be to detect an attempt to exploit a vulnerability in Wireshark, where parsing specific traffic causes a buffer overflow on the machine parsing the traffic. The exploit-db link in the rule shows the details of the exploit for this issue.

Not the answer you're looking for? Browse other questions tagged or ask your own question.