[Snort-sigs] signature for SoulSeek P2P?

marcamone at ...1143... marcamone at ...1143...
Mon Aug 16 07:52:42 EDT 2004


See how these work:
alert tcp $HOME_NET any -> 38.115.131.0/24 2240 (msg:"P2P Soulseek traffic"; classtype:policy-violation; sid:1000001; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P Soulseek"; content:"slsknet"; classtype:policy-violation; sid:1000002; rev:1;)
-----Original Message-----
From: snort-sigs-admin at lists.sourceforge.net [mailto:snort-sigs-admin at lists.sourceforge.net] On Behalf Of twebster at ...2725...
Sent: Thursday, August 12, 2004 1:38 PM
To: snort-sigs at lists.sourceforge.net
Subject: [Snort-sigs] signature for SoulSeek P2P?

Does anyone have a snort signature to detect SoulSeek (www.slsknet.org) file sharing traffic?
thanks
tony

-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20040816/8a1e7fb8/attachment.html>


More information about the Snort-sigs mailing list