[Snort-sigs] new Q signature

Jon warchild at ...288...
Wed Feb 12 09:27:01 EST 2003


On Mon, Feb 10, 2003 at 02:53:11PM -0500, Jon wrote:

> Any information would be greatly appreciated.

Just as a follow-up...

I have located a site that consistantly emits these packets after you visit
their site.  I happened upon this site after a google search, and within
seconds, the Q signature was triggering.

I've verified that this host will send the 'cko' packet regardless of where
I come from, so it doesn't appear to be specific to the network that I
watch.  Note that if your sensor is behind a firewall that does some sort
of stateful filtering, the packets may not make it through.

Anyway, here it is:

http://osr5doc.ca.caldera.com:457/NetAdminG/autoT.advanced_map_options.html

Fyi, and thanks.

-jon




More information about the Snort-sigs mailing list