[Snort-sigs] Signature for psychoid's Broadscan tool

Joe Stewart jstewart at ...5...
Mon Dec 11 20:24:06 EST 2000


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This tool scans common broadcast addresses looking for potential smurf 
amplifier networks.

alert ICMP !$HOME_NET any <> $HOME_NET any (msg:"PING-Broadscan Smurf 
Scanner"; itype: 8; icmp_id: 0; icmp_seq: 0; dsize:4; )

- -- 
Joe Stewart  
Information Security Analyst 
jstewart at ...5...  
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjo1fj0ACgkQkbW2pYIjPYhYSgCfZFMsyyLs0Uu6PQc9wi7Bdo2D
4IsAnRK/UGp/INhUrMQRrRmh30MpBjSY
=Ya8k
-----END PGP SIGNATURE-----



More information about the Snort-sigs mailing list