*** EX RELS 03317 Release *** Total number of signatures: 6020 Description ================================================================== In this signature, we addressed the exploits/vulnerabilities and applications as below: Added 3 rule(s): --------------- 1133495 WEB Generic Shellcode Obfuscation -1 1133496 TELNET DBLTek GoIP Backdoor Access 1133500 WEB Apache Struts Dynamic Method Invocation Remote Code Execution -1.u Modified 469 rule(s): --------------- 1048888 NETWORK L3retriever Ping via ICMP -1 1048891 NETWORK icmpenum v1.1.1 via ICMP -1 1048892 NETWORK redirect host connect via ICMP -1 1048893 NETWORK redirect net via ICMP -1 1048897 NETWORK Source Quench connect via ICMP -1 1048900 NETWORK TJPingPro1.1Build 2 Windows connect via ICMP -1 1048901 NETWORK PING WhatsupGold Windows connect via ICMP -1 1048904 NETWORK Destination Unreachable connect via ICMP -1 1048905 NETWORK Destination Unreachable connect via ICMP -2 1048906 NETWORK Destination Unreachable connect via ICMP -3 1048917 NETWORK PING LINUX/*BSD connect via ICMP -1 1048925 NETWORK PING connect via ICMP -1 1048926 NETWORK traceroute connect via ICMP -1 1048927 NETWORK Address Mask Reply connect via ICMP -1 1048929 NETWORK Address Mask Request connect via ICMP -1 1048931 NETWORK Alternate Host Address connect via ICMP -1 1048933 NETWORK Datagram Conversion Error connect via ICMP -1 1048935 NETWORK Destination Unreachable connect via ICMP -4 1048936 NETWORK Destination Unreachable connect via ICMP -5 1048937 NETWORK Destination Unreachable connect via ICMP -6 1048938 NETWORK Destination Unreachable connect via ICMP -7 1048939 NETWORK Destination Unreachable connect via ICMP -8 1048940 NETWORK Destination Unreachable connect via ICMP -9 1048941 NETWORK Destination Unreachable connect via ICMP -10 1048942 NETWORK Destination Unreachable connect via ICMP -11 1048943 NETWORK Destination Unreachable connect via ICMP -12 1048944 NETWORK Destination Unreachable connect via ICMP -13 1048945 NETWORK Destination Unreachable connect via ICMP -14 1048946 NETWORK Destination Unreachable connect via ICMP -15 1048947 NETWORK Destination Unreachable connect via ICMP -16 1048951 NETWORK Fragment Reassembly Time Exceeded connect via ICMP -1 1048956 NETWORK Information Reply connect via ICMP -1 1048958 NETWORK Information Request connect via ICMP -1 1048960 NETWORK Mobile Host Redirect connect via ICMP -1 1048962 NETWORK Mobile Registration Reply connect via ICMP -1 1048964 NETWORK Mobile Registration Request connect via ICMP -1 1048966 NETWORK Parameter Problem (Bad Length) connect via ICMP -1 1048967 NETWORK Parameter Problem (Missing a Requiered Option) connect via ICMP -1 1048968 NETWORK Parameter Problem (Unspecified Error) connect via ICMP -1 1048970 NETWORK Photuris (Reserved) connect via ICMP -1 1048971 NETWORK Photuris (Unknown Security Parameters Index) connect via ICMP -1 1048972 NETWORK Photuris (Authentication Failed) connect via ICMP -1 1048973 NETWORK Photuris (Decryption Failed) connect via ICMP -1 1048975 NETWORK Redirect (for TOS and Host) connect via ICMP -1 1048976 NETWORK Redirect (for TOS and Network) connect via ICMP -1 1048978 NETWORK Reserved for Security (Type 19) connect via ICMP -1 1048980 NETWORK Router Advertisement connect via ICMP -1 1048981 NETWORK Router Selection connect via ICMP -1 1048982 NETWORK SKIP connect via ICMP -1 1048985 NETWORK Time-To-Live Exceeded in Transit connect via ICMP -1 1048987 NETWORK Timestamp Reply connect via ICMP -1 1048989 NETWORK Timestamp Request connect via ICMP -1 1048991 NETWORK Traceroute ipopts connect via ICMP -1 1049008 NETWORK Large ICMP Packet via ICMP -1 1049016 TERMINAL PCAnywhere Attempted Administrator login via TCP -1 1049021 TERMINAL PCAnywhere Failed login via TCP -1 1049071 TERMINAL PCAnywhere server response access via UDP -1 1050288 NETWORK source route - lsrr connect via ICMP -1 1050290 NETWORK sourceroute-ssrr connect via ICMP -1 1050946 FILE FTP transfer-upload via TCP -1 1050947 FILE FTP transfer-download via TCP -1 1051140 NETWORK PING SoftEther Keep-Alive connect via ICMP -1 1051212 P2P Gnutella transfer via TCP -1 1051213 P2P DirectConnect transfer via TCP -1 1051254 P2P FastTrack transfer via TCP -1 1051685 P2P eDonkey login server via TCP -1 1051701 TUNNEL VNN Client login via UDP -1 1051738 WEB ActiveX Control transfer via TCP -1 1051783 P2P Gnutella connect via TCP -1 1051785 P2P Gnutella ping communicate via UDP -1 1051793 IM QQ/TM login via TCP -1 1051820 WEB Java Applet transfer via TCP -1 1051821 WEB Java Applet transfer via TCP -2 1051825 MEDIA Windows Media Player media via TCP -2 1051826 MEDIA Windows Media Player media via TCP -3 1051827 MEDIA Windows Media Player media via TCP -4 1051870 WEB Java Applet transfer via TCP -3 1051873 IM Rediff BOL login via TCP -1 1051874 IM Rediff BOL communicate via TCP -1 1051875 IM Rediff BOL transfer via TCP -1 1051876 IM Rediff BOL media-audio via TCP -1 1051877 IM Rediff BOL communicate via TCP -2 1051900 P2P DirectConnect $Supports access via TCP -1 1051901 P2P DirectConnect access via TCP -1 1051904 P2P FastTrack ping communicate via UDP -1 1051937 P2P eDonkey-Overnet Publish communicate via UDP -1 1051997 P2P Gnutella-Bearshare transfer via UDP -1 1051998 P2P eDonkey Hello communicate via TCP -1 1052024 P2P eDonkey Request parts communicate via TCP -1 1052032 IM QQ/TM login via TCP -4 1052034 IM Rediff BOL login via TCP -2 1052039 P2P Gnutella communicate via TCP -1 1052056 IM QQ/TM transfer via TCP -1 1052057 IM QQ/TM transfer via UDP -1 1052058 P2P eDonkey Hello answer communicate via TCP -2 1052059 IM QQ/TM transfer via UDP -2 1052062 IM QQ/TM media-audio via TCP -1 1052080 WEB ActiveX Control transfer via TCP -2 1052081 WEB ActiveX Control transfer via TCP -3 1052082 WEB ActiveX Control transfer via TCP -4 1052108 TERMINAL PcAnywhere Access Port-5631 connect via TCP -1 1052110 IM QQ/TM login via TCP -6 1052111 IM QQ/TM login via TCP -7 1052290 TUNNEL TinyVPN login via TCP -1 1052292 P2P Thunder transfer via TCP -2 1052582 MEDIA MP3 file media via TCP -1 1052603 IM Gadu-Gadu login via TCP -1 1052607 IM Rediff BOL login via TCP -3 1052622 IM QQ/TM transfer via UDP -4 1052637 P2P Gnutella-Foxy communicate via TCP-1 1052668 TUNNEL Ping Tunnel connect via ICMP -1 1052681 P2P Thunder transfer via TCP -3 1052684 P2P Thunder transfer via TCP -4 1052692 P2P Vagaa access via UDP -1 1052693 P2P Vagaa access via UDP -2 1052694 P2P Vagaa transfer via TCP -1 1052734 P2P FastTrack transfer via TCP -2 1052808 P2P Thunder transfer via TCP -5 1052833 P2P Gnutella transfer via UDP -1 1052835 IM QQ/TM login via TCP -11 1052836 IM QQ/TM login via TCP -12 1052838 IM QQ/TM transfer via UDP -6 1052849 NETWORK NETBIOS SMB Empty Password Failed access via TCP -1 1052857 TUNNEL VNN Client login via UDP -2 1052881 P2P Thunder transfer via TCP -6 1052887 P2P eDonkey-easyMule access via UDP -1 1052918 MEDIA Windows Media Player media via TCP -5 1052993 P2P Ares access via TCP -2 1052994 P2P Ares access via UDP -1 1053017 P2P Thunder transfer via TCP -9 1053043 TUNNEL HTTP Proxy Server communicate via TCP -1 1053098 P2P KCeasy connect via TCP -1 1053195 MEDIA FLV file media via TCP -1 1053199 IM Paltalk login via TCP -1 1053205 IM Gadu-Gadu login via TCP -2 1053218 IM WinpopupX login via UDP -1 1053222 IM QQ/TM login via UDP -2 1053225 P2P eDonkey-easyMule access via TCP -1 1053227 GAME Ourgame login via TCP -2 1053229 GAME Sina Web login via TCP -1 1053231 GAME Chinagame login via TCP -1 1053245 GAME Legend login via TCP -1 1053246 GAME Legend login via TCP -2 1053249 GAME WoW login via TCP -1 1053271 GAME Realgame login via TCP -1 1053273 MEDIA FLV file media via TCP -2 1053296 P2P Thunder access via TCP -1 1053297 P2P Thunder access via TCP -2 1053298 P2P Thunder access via TCP -3 1053299 P2P Thunder access via TCP -4 1053310 TUNNEL VNN Client login via TCP -1 1053329 IM QQ/TM login via TCP -14 1053367 P2P BT-BitComet transfer via TCP -1 1053409 TERMINAL PCAnywhere connect via TCP -1 1053423 IM QQ/TM transfer via UDP -7 1053426 P2P Gnutella-Foxy communicate via TCP-4 1053432 IM QQ/TM login via UDP -3 1053449 P2P QQDownload transfer via TCP -2 1053461 IM Caihong login via TCP -1 1053485 TCP port 18 traffic (eg. Message Send Protocol) 1053489 TCP port 22 traffic (eg. Secure Shell (SSH)) 1053490 TCP port 23 traffic (eg. Telnet) 1053493 UDP port 22 traffic (eg. Secure Shell (SSH)) 1053494 TCP port 107 traffic (eg. Telnet) 1053503 UDP port 18 traffic (eg. Message Send Protocol) 1053520 TCP port 53 traffic (eg. DNS) 1053521 UDP port 53 traffic (eg. DNS) 1053532 TCP port 79 traffic (eg. Finger protocol) 1053535 TCP port 88 traffic (eg. Kerberos) 1053544 NETWORK DNS query access via UDP -1 1053547 P2P BT-BitComet access via TCP -1 1053551 MEDIA Windows Media Player media via TCP -1 1053552 MEDIA MMS/WMSP file media via TCP -1 1053557 WEB HTTP access via TCP -1 1053558 P2P BT-BitComet access via TCP -3 1053569 UDP port 1900 traffic (eg. SSDP) 1053572 NETWORK NETBIOS SMB access via TCP -1 1053574 UDP port 138 traffic (eg. SMB) 1053591 GAME Ourgame login via TCP -3 1053609 IM Fetion communicate via TCP -1 1053641 IM Fetion login via SSL -1 1053643 IM Fetion transfer via TCP -1 1053644 IM Fetion transfer via TCP -2 1053645 IM Fetion communicate via TCP -2 1053650 IM Fetion media-audio via TCP -1 1053651 MEDIA FLV file media via TCP -3 1053656 IM QQ/TM login via UDP -5 1053701 IM Digsby login via TCP -1 1053702 IM Heyyo login via TCP -1 1053708 IM Alicall login via UDP -1 1053709 IM Alicall login via TCP -1 1053729 IM Netcall login via TCP -1 1053733 IM Etnano login via UDP -1 1053830 TUNNEL Freegate login via UDP -1 1053831 TUNNEL Freegate login via TCP -1 1053832 TUNNEL Freegate login via TCP -2 1053836 TUNNEL Freegate login via TCP -3 1053862 P2P Ares access via UDP -2 1053869 AP State - TUNNEL Freegate http request fragment evasion 0-1 1053872 IM Fetion login via SSL -2 1053873 P2P Gnutella-Cabos connect via UDP -1 1053877 P2P QQDownload transfer via TCP -4 1053887 TCP port 80 traffic (eg. HTTP) 1053888 TCP port 25 traffic (eg. SMTP) 1053907 P2P Gnutella-Foxy transfer via UDP-1 1054145 P2P Ares access via TCP -3 1054147 P2P Ares access via UDP -3 1054152 P2P BT-Vuze communicate via TCP -1 1054153 P2P BT-Vuze communicate via TCP -2 1057374 EXPLOIT Novell File Reporter VOL Tag Stack Buffer Overflow -1 1059684 MISC Bitcoin/LiteCoin/Dogecoin Mining Activity -1 1060113 BUSINESS Webex-WebOffice login via TCP -2 1060185 DB_ERP Centriccrm erp-crm login via TCP -1 1060186 DB_ERP Centriccrm erp-crm login via SSL -1 1060207 IM Pichat login via TCP -1 1060217 MEDIA Babelgum access via TCP -1 1060223 BUSINESS Webex-WebOffice login via TCP -1 1060224 TERMINAL Telnet communicate via TCP -1 1060225 TERMINAL Beinsync login via SSL -1 1060226 TERMINAL Beinsync login via TCP -1 1060229 TERMINAL MS RDP communicate via TCP -1 1060235 P2P Pando connect via TCP -1 1060236 UPDATE TrendMicro transfer via TCP -1 1060237 UPDATE Kaspersky transfer via TCP -1 1060238 UPDATE Kaspersky transfer via TCP -2 1060248 UPDATE InstallAnyWhere transfer via TCP -1 1060265 UPDATE Yum transfer via TCP -1 1060266 GAME Wolfenstein access via UDP-1 1060273 UPDATE Jiangmin transfer via TCP -1 1060278 UPDATE PCTools transfer via TCP -1 1060286 UPDATE McAfee transfer via TCP -1 1060300 TCP port 110 traffic (eg. POP3) 1060311 TCP port 411 traffic (eg. DirectConnect) 1060312 TCP port 412 traffic (eg. DirectConnect) 1060334 TCP port 119 traffic (eg. NNTP) 1060340 TCP port 981 traffic (eg. SofaWare) 1060350 TCP port 143 traffic (eg. IMAP4) 1060351 UDP port 143 traffic (eg. IMAP4) 1060358 TCP port 161 traffic (eg. SNMP) 1060359 UDP port 161 traffic (eg. SNMP) 1060360 TCP port 162 traffic (eg. SNMP) 1060361 UDP port 162 traffic (eg. SNMP) 1060375 TCP port 563 traffic (eg. NNTP) 1060376 UDP port 563 traffic (eg. NNTP) 1060377 TCP port 220 traffic (eg. IMAP4) 1060378 UDP port 220 traffic (eg. IMAP4) 1060409 TCP port 587 traffic (eg. SMTP) 1060431 TCP port 657 traffic (eg. IBM Remote monitoring and Control) 1060432 UDP port 657 traffic (eg. IBM Remote monitoring and Control) 1060435 TCP port 647 traffic (eg. WatchGuard Web Management UI) 1060447 TCP port 749 traffic (eg. Kerberos) 1060448 UDP port 749 traffic (eg. Kerberos) 1060463 TCP port 953 traffic (eg. DNS) 1060464 UDP port 953 traffic (eg. DNS) 1060471 TCP port 992 traffic (eg. Telnet) 1060472 UDP port 992 traffic (eg. Telnet) 1060473 TCP port 993 traffic (eg. IMAP4) 1060474 TCP port 995 traffic (eg. POP3) 1060477 TCP port 464 traffic (eg. Kerberos) 1060478 UDP port 464 traffic (eg. Kerberos) 1060505 TCP port 543 traffic (eg. Kerberos) 1060506 TCP port 544 traffic (eg. Kerberos) 1060644 P2P Thunder connect via TCP -1 1060735 TCP port 8081 traffic (eg. HTTP) 1060774 TCP port 5555 traffic (eg. Freeciv) 1060796 TCP port 4993 traffic (eg. FTP Applications) 1060797 UDP port 4993 traffic (eg. FTP Applications) 1060819 UDP port 2211 traffic (eg. EMWIN) 1060825 TCP port 8080 traffic (eg. HTTP) 1060867 TCP port 1813 traffic (eg. Radacct RADIUS) 1060868 UDP port 1813 traffic (eg. Radacct RADIUS) 1060882 UDP port 1198 traffic (eg. CAJO) 1060936 TCP port 8008 traffic (eg. IBM HTTP) 1060950 TCP port 4125 traffic (eg. Microsoft Remote Web Workplace) 1061003 TCP port 1182 traffic (eg. WatchGuard Authentication Access) 1061004 UDP port 1182 traffic (eg. WatchGuard Authentication Access) 1061005 TCP port 6969 traffic (eg. WatchGuard SSLVPN) 1061006 UDP port 6969 traffic (eg. WatchGuard SSLVPN) 1061007 TCP port 2161 traffic (eg. WatchGuard CLI ) 1061009 TCP port 6101 traffic (eg. BackupExec) 1061034 TCP port 1025 traffic (eg. NFS) 1061060 TCP port 19813 traffic (eg. WatchGuard WSM Management) 1061084 P2P Ares access via TCP -1 1061111 UDP port 5421 traffic (eg. NetSupport) 1061114 UDP port 5405 traffic (eg. NetSupport) 1061134 TCP port 2002 traffic (eg. WatchGuard external Webblocker database fetch) 1061221 IM Jctrans communicate via TCP -1 1061239 P2P Hydranode access via TCP -1 1061284 P2P MooPolice access via TCP -1 1061348 TCP port 3030 traffic (eg. NetPanzer) 1061349 UDP port 3030 traffic (eg. NetPanzer) 1061359 P2P uTorrent access via TCP -1 1061386 GAME WOW access via TCP -1 1061436 TCP port 5106 traffic (eg. A-Talk) 1061437 TCP port 5107 traffic (eg. A-Talk) 1061460 TCP port 27015 traffic (eg. Half-Life) 1061557 BUSINESS Microsoft-dtc access via TCP -1 1061560 TCP port 1109 traffic (eg. Kerberos) 1061635 P2P QQDownload transfer via TCP -1 1061637 P2P QQDownload transfer via TCP -3 1061710 P2P eDonkey-easyMule access via TCP -2 1061726 P2P eDonkey-easyMule access via UDP -2 1061727 P2P eDonkey-easyMule access via UDP -3 1061734 GAME WOW login via TCP -2 1061739 P2P BT-Vuze communicate via TCP -3 1061777 MEDIA WebStreaming audio media via TCP -1 1061780 TUNNEL Freegate login via TCP -4 1061803 P2P Gnutella-Bearshare communicate via UDP -1 1061806 AP State Flow- TUNNEL Freegate http request fragment evasion 1-F/Flow 1061816 IM Fetion login via TCP -3 1062401 P2P Vagaa access via UDP -3 1062402 P2P Vagaa access via TCP -1 1062411 TCP port 3306 traffic (eg. MySQL) 1062412 UDP port 3306 traffic (eg. MySQL) 1062439 MEDIA WebStreaming video media via TCP -1 1062452 TERMINAL Telnet communicate via TCP -2 1062453 TERMINAL Secure Shell (SSH) login 1063148 P2P BT-Vuze communicate via UDP -1 1063211 P2P eDonkey-eMule/Vagaa Version Check via TCP -1 1063215 P2P Gnutella-Foxy communicate via TCP-5 1063224 P2P Thunder Series Version Check via TCP -1 1063290 P2P BT-Vuze communicate via UDP -2 1063332 VOIP MSRP communicate via TCP -1 1063356 GAME WoW communicate via TCP -2 1063364 MEDIA TudouVa communicate via TCP -1 1063365 MEDIA TudouVa communicate via TCP -2 1063390 GAME Sina Web login via TCP -2 1063392 IM Fetion login via TCP -4 1063393 IM Fetion login via TCP -5 1063394 IM Fetion media-audio via TCP -2 1063395 IM Fetion media-video via TCP -3 1063404 MAIL IMAP4 connect via TCP -1 1063405 MAIL NNTP connect via TCP -1 1063433 P2P QQDownload transfer via TCP -5 1063455 IM QQ/TM transfer via UDP -8 1063456 IM QQ/TM transfer via TCP -5 1063483 IM QQ/TM transfer via UDP -9 1063499 IM Fetion transfer via TCP -3 1063544 WEB RSS access via TCP -1 1063587 IM Digsby login via TCP -2 1063594 MEDIA Windows Media Player UPnP access via TCP -1 1063669 TERMINAL Beinsync login via TCP -2 1063980 MAIL SMTP access state 0 via TCP -1 1063981 MAIL SMTP access state 0 via TCP -2 1063982 MAIL SMTP access state 1 via TCP -1 1063983 MAIL SMTP access via TCP -1 1063984 MAIL SMTP access via TCP -2 1063985 MAIL SMTP access via TCP -3 1063986 MAIL POP3 login state 0 via TCP -1 1063987 MAIL POP3 login state 1 via TCP -1 1063988 MAIL POP3 login via TCP -1 1063989 FILE FTP login state 0 via TCP -1 1063990 FILE FTP login state 1 via TCP -1 1063991 FILE FTP login state 2 via TCP -1 1063992 FILE FTP login via TCP -1 1064000 TUNNEL Freegate login via UDP -2 1064020 IM Alicall login via TCP -2 1064021 IM Alicall login via TCP -3 1064063 IM Digsby login via TCP -3 1064079 GAME Realgame login via TCP -2 1064150 NETWORK DCE-RPC access via TCP -1 1064151 NETWORK DCE-RPC access via TCP -2 1064162 IM QQ/TM login via UDP -1 1064188 P2P eDonkey-easyMule access via SSL -1 1064191 P2P BT-BitComet transfer via TCP -2 1064192 IM QQ/TM login via TCP -2 1064198 P2P Pando access via SSL -1 1064372 IM QQ/TM login via TCP -5 1064373 IM QQ/TM login via UDP -4 1064377 TUNNEL Freegate login via UDP -3 1064378 TUNNEL Freegate login via UDP -4 1064393 IM QQ/TM login via TCP -8 1064399 TUNNEL VNN Client login via TCP -2 1064406 IM Paltalk login via TCP -2 1064521 MAIL IMAP4 login state 0 via TCP -1 1064522 MAIL IMAP4 login state 1 via TCP -1 1064523 MAIL IMAP4 login via TCP -1 1064983 TUNNEL Freegate login via UDP -5 1064984 TUNNEL Freegate login via UDP -6 1064985 TUNNEL Freegate login via UDP -7 1064986 TUNNEL Freegate login via UDP -8 1065480 IM QQ/TM login via TCP -15 1065490 P2P QQDownload transfer via TCP -6 1065491 P2P QQDownload transfer via UDP -1 1065492 P2P QQDownload transfer via TCP -7 1065502 P2P Ares access via TCP -4 1065503 P2P Ares media via TCP -3 1065535 IM QQ/TM transfer via TCP -6 1065710 P2P BT-Vuze communicate via TCP -4 1065784 WEB Yahoo Slurp crawler access via TCP -1 1065787 WEB Microsoft bingbot crawler access via TCP -1 1065788 WEB Googlebot crawler access via TCP -1 1065789 WEB Googlebot crawler access via TCP -2 1065790 WEB Googlebot crawler access via TCP -3 1065791 WEB Abot crawler access via TCP -1 1065792 WEB HTTrack crawler access via TCP -1 1065793 WEB Win Web Crawler access via TCP -1 1065794 WEB ZoomSpider crawler access via TCP -1 1065795 UPDATE Kaspersky transfer via TCP -3 1065834 TUNNEL Freegate login via UDP -9 1065950 MAIL NNTP connect via TCP -2 1066057 IM Alicall login via TCP -4 1066058 IM Alicall access via TCP -1 1066059 IM Alicall access via TCP -2 1066068 MEDIA TudouVa communicate via TCP -3 1066232 P2P Thunder access via TCP -5 1066234 MAIL IMAP4 login state 1 via TCP -2 1066236 MAIL IMAP4 login via TCP -2 1066388 IM Fetion transfer via TCP -4 1066401 NETWORK PING connect via ICMPv6 -1 1066504 NETWORK Echo Reply connect via ICMPv6 -1 1066505 NETWORK Destination Unreachable connect via ICMPv6 -1 1066506 NETWORK Packet Too Big connect via ICMPv6 -1 1066507 NETWORK Time Exceeded connect via ICMPv6 -1 1066508 NETWORK Parameter Problem connect via ICMPv6 -1 1066509 NETWORK Router Solicitation connect via ICMPv6 -1 1066510 NETWORK Router Advertisement connect via ICMPv6 -1 1066511 NETWORK Neighbor Solicitation connect via ICMPv6 -1 1066512 NETWORK Neighbor Advertisement connect via ICMPv6 -1 1066513 NETWORK Redirect Message connect via ICMPv6 -1 1066514 NETWORK connect via ICMPv6 -1 1066884 BUSINESS Webex-WebOffice access via TCP -1 1067096 TERMINAL Telnet communicate via TCP -3 1067097 TERMINAL Telnet communicate via TCP -4 1067142 IM Fetion login via TCP -6 1067143 IM Fetion transfer via TCP -5 1067144 IM Fetion media-video via TCP -4 1067272 P2P QQDownload access via TCP -1 1067343 IM QQ/TM login via TCP -16 1067436 TUNNEL VNN Client login via TCP -3 1067523 UPDATE TrendMicro transfer via TCP -2 1067543 IM QQ/TM media-audio via TCP -2 1067544 IM QQ/TM media-video via TCP -1 1067580 IM QQ/TM media-video via UDP -1 1067612 P2P Thunder transfer via TCP -7 1067737 TERMINAL pcAnywhere connect via TCP -2 1067740 P2P Thunder transfer via TCP -8 1067741 MEDIA MP3 file media via TCP -2 1067851 IM QQ/TM media via UDP -1 1067931 GAME WOW access via TCP -2 1068063 P2P Thunder transfer via TCP -11 1068094 FILE FTP login via TCP -2 1068268 TERMINAL MS RDP communicate via TCP -2 1068269 TERMINAL MS RDP communicate via TCP -3 1068327 MEDIA WebStreaming mkv media via TCP -1 1068328 MEDIA WebStreaming mkv media via TCP -2 1068745 TERMINAL MS RDP communicate via UDP -1 1068861 GAME Ourgame access via TCP -1 1068862 GAME Ourgame access via TCP -2 1068889 GAME WOW transfer via TCP -1 1069077 SG - P2P BitComet connection via UDP 1069104 P2P Ares access via TCP -5 1069622 WEB HTTP access via TCP -3 1080002 SG - P2P eDonkey connect via TCP 1080019 SG - TUNNEL Freegate login via TCP/UDP 1090349 NETWORK DNS Name Resolution access via UDP -1 1090350 NETWORK DNS Zone Transfer via TCP -1 1090351 NETWORK Finger (finger user) S via TCP -1 1090352 NETWORK Finger (finger user) U via TCP -1 1132543 WEB Apache Struts Dynamic Method Invocation Remote Code Execution -1.h 1133079 WEB-CLIENT Microsoft Edge CVE-2016-3386 Memory Corruption (CVE-2016-3386) 1133189 MISC Bitcoin/LiteCoin/Dogecoin Mining Activity -2 1160102 IM Gadu-Gadu access via SSL -1 1190003 TCP port 51413 traffic (eg. BitTorrent-Transmission) 1190012 UDP port 1812 traffic (eg. radius) 1190015 UDP port 2049 traffic (eg. NFS) 1190020 UDP port 80 traffic (eg. HTTP) 1190032 UDP port 4444 traffic (eg. krb524) 1190033 UDP port 88 traffic (eg. kerberos) Deleted 0 rule(s): ---------------