[Snort-sigs] Bit Torrent signature

Chris Green cmg at ...435...
Tue Jun 17 06:16:05 EDT 2003


Jukka Juslin <jtjuslin at ...1151...> writes:

> Dear all,
>
> Does anybody have a signature for Bit Torrent? AFAIK, Bit Torrent is
> popular for transfers of DVD movies etc.
>

<digression>
Yeah Bit Torrent is awesome for Etree. I just wish there
was a nice server low load that could start replacing FTPds like
sunsite.
</digression>

You can probably do a signature for

alert tcp $HOME_NET any -> $EXTERNAL_NET any \
(msg: "Someone's finding torrent files "; content: ".torrent"; \
 flow: established,to_server;)

-- 
Chris Green <cmg at ...435...>
Don't use a big word where a diminutive one will suffice.




More information about the Snort-sigs mailing list