Hello Jerome, I've got this to work earlier but i'm trying to think of why your signature is firing in the opposite direction. I guess IPS checks the direction based on the source and destination ports of the packets. If you have configured it to check the packets going "to" the service, then i guess it will look at all TCP packets with a destination port = 23.This "should" fire the signature :/
Still thinking :) Cheers, TacACK
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
