The following flowbit signatures are purely for associated signatures to generate an alert.

Some IDS signatures are called “flowbits” signatures, and are used in conjunction with secondary signatures. The signature captures a particular type traffic which is fed to other signatures that trigger an alert or block action. These are purposely set to be silent (no-alert) because they would trigger noisy false positives. No signature with “flowbits:noalert” should be set to drop.

A signature action on these is not valid:

4100456 4009397
4100501 4009398
4100541 4009399
4100542 4009400
4100648 4009401
4100660 4009402
4100696 4009403
4100698 4009404
4100723 4009405
4100724 4009406
4100757 4009407
4100773 4009409
4100811 4009413
4101043 4009476
4101094 4009684
4101252 4009685
4101272 4009775
4101273 4009776
4101327 4009777
4101332 4009778
4101367 4010014
4101371 4010015
4101410 4010045
4101411 4010046
4101433 4010048
4101608 4010093
4101718 4010094
4101722 4010095
4101729 4010544
4101959 4010545
4101969 4010602
4102141 4011031
4102220 4011054
4102238 4011398
4102338 4011399
4102355 4011400
4102365 4011801
4102445 2021381
4102598 2026514
4102655 2027507
4000379 2027672
4000596 2027673
4000601 2027674
4000635 2027734
4000735 2018050
4000839 2027955
4000886 2027957
4000887 2027958
4001659 2020154
4001838 2021150
4002094 2022131
4002168 2022882
4002608 2023182
4002705 2024772
4002805 2024773
4003322 2024774
4003737 2024775
4003738 2025068
4004182 2026489
4004204 2026490
4004322 2027395
4004371 2011456
4004452 2014096
4004453 2016539
4004945 2018754
4005329 2019668
4005355 2019738
4005359 2019901
4005532 2020420
4005993 2020573
4006225 2023087
4006667 2023766
4007072 2024928
4007389 2025086
4007517 2028945
4007573 2028946
4007596 2029127
4007607 2029338
4008153 2029352
4009124 2029455
4009383 2018463
4009384 2029477
4009385 2024604
4009386 2029814
4009387 2029986
4009389 2030027
4009392 2009240
4009393 2018570
4009394 2018571
4009395 2030180
4009396 2021531
2022317