[Snort-sigs] new Q signature
warchild at ...288...
Wed Feb 12 09:27:01 EST 2003
On Mon, Feb 10, 2003 at 02:53:11PM -0500, Jon wrote:
> Any information would be greatly appreciated.
Just as a follow-up...
I have located a site that consistantly emits these packets after you visit
their site. I happened upon this site after a google search, and within
seconds, the Q signature was triggering.
I've verified that this host will send the 'cko' packet regardless of where
I come from, so it doesn't appear to be specific to the network that I
watch. Note that if your sensor is behind a firewall that does some sort
of stateful filtering, the packets may not make it through.
Anyway, here it is:
Fyi, and thanks.
More information about the Snort-sigs