[Snort-openappid] Repeating Pcap

Mark Gomand twilights_exile at yahoo.com
Tue Jun 25 14:07:45 EDT 2019


Hi everyone,
I am fairly new to Snort so forgive any ignorance. I am trying to create a snort rule that identifies repeating bytes in a pcap. For example FF FF FF FF repeated or 21 21 21 21 21. The repeating pcaps are not alwasy the same so creating a rule that looks just for a known repeating signature won't work. Thank you in advanced for any information.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-openappid/attachments/20190625/f3d02949/attachment.html>


More information about the Snort-openappid mailing list