[Snort-sigs] Yahoo Messenger signature

tyler at ...337... tyler at ...337...
Wed Feb 6 08:26:02 EST 2002

Seems to work for me with resp:rst_all ---  Let me know what you think, it's
my first contribution :-D

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Yahoo Messenger access";
content:"|594D534709|"; \
depth:5; flags:AP+; classtype:misc-activity; resp:rst_all;)


This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager at postmaster at ...338...

More information about the Snort-sigs mailing list