I'm seeing a lot of false positives on this rule - shouldn't the flow selector be limited to mssql ports? This is obviously ipsec udp traffic.
Message........: MS-SQL probe response overflow attempt
Packet dropped.: no
Priority.......: 1 (high)
Classification.: Attempted User Privilege Gain
IP protocol....: 17 (UDP)
Source IP address:
Source port: 4500 (ipsec-msft)
Destination IP address:
Destination port: 4500 (ipsec-msft)
This thread was automatically locked due to age.
