[Snort-sigs] Experimental Streaming audio signatures

Chris Green cmg at ...435...
Fri Mar 22 13:58:05 EST 2002


Oops - forgot the : part as was pointed out to me :-)

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 \
    (msg: "Possible QuickTime User"; \
      content: "User-Agent\: Quicktime";)

alert tcp $EXTERNAL_NET 80 -> $HOME_NET any \
    (msg: "Windows Media -- Audio"; \
     content: "Content-type\: audio/x-ms-wma\r\n";)

alert tcp $EXTERNAL_NET 80 -> $HOME_NET any \
        (msg: "Windows Media -- Video"; \
         content: "Content-type\: video/x-ms-asf\r\n";)

alert tcp $EXTERNAL_NET 80 -> $HOME_NET any \
   (msg:"Shoutcast Redirection to playlist"; \
     content: "Content-type\: audio/x-scpls\r\n";)

alert tcp $EXTERNAL_NET 80 -> $HOME_NET any \
    (msg:"Icecast Redirection to playlist"; \
     content: "Content-type\: audio/x-mpegurl\r\n";)

-- 
Chris Green <cmg at ...435...>
This is my signature. There are many like it but this one is mine.





More information about the Snort-sigs mailing list