[Snort-sigs] Yahoo Messenger signature

Michael Scheidell scheidell at ...249...
Wed Feb 6 08:39:19 EST 2002


> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Yahoo Messenger access";
> content:"|594D534709|"; \
> depth:5; flags:AP+; classtype:misc-activity; resp:rst_all;)

What about a port range? this will 'scan' the first 5 bytes of every
connection.

-- 
Michael Scheidell
Secnap Network Security, LLC
(561) 368-9561 scheidell at ...249...
Sign up Live WEBCAST Q & A : Should I migrate from IIS? http://www.secnap.net/





More information about the Snort-sigs mailing list