[Snort-sigs] Info for SID 1432

Rui Martins rmartins at ...1189...
Tue Jan 21 22:02:02 EST 2003


# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others.  References in the rules themselves
# should be used for linking to other's work. 
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
# 
# $Id$
#
# 

Rule:  

	message P2P GNUTella GET 


--
Sid:

          SID 1432
--
Summary:

--
Impact:

--
Detailed Information:

--
Attack Scenarios:

--
Ease of Attack:

--
False Positives:

Sometimes, a user using a web browser to a site and making a "normal" Get
can cause this alert. It´s common with the string "GET /search" and it´s
normal a GNUTella user.

--
False Negatives:

--
Corrective Action:

--
Contributors:

-- 
Additional References:


------------------------------------------------------
Rui Pedro Martins
Técnico de Sistemas

ruipmartins at ...1190...
rmartins at ...1189...
___________________________________________
| Criando conteúdo em português:                                          
|  http://www.geocities.com/Athens/Forum/3257/index.htm
<http://www.geocities.com/Athens/Forum/3257/index.htm>  
| *** Os Descobrimentos Portugueses
|  http://www.terravista.pt/Ancora/1212/index.htm
<http://www.terravista.pt/Ancora/1212/index.htm>                
| *** As Armas Secretas Alemãs da II Guerra Mundial
| http://members.tripod.com/~ruipmartins/index.html
<http://members.tripod.com/~ruipmartins/index.html> 
| *** As Ilhas Míticas do Atlântico
 ooo0
( ( )
 \ (   0ooo
  \_)  ( ) )
        ) /
 ooo0  (_/
( ( )
 \ (   0ooo
  \_)  ( ) )
        ) /
       (_/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20030121/90789dbc/attachment.html>


More information about the Snort-sigs mailing list