[Snort-sigs] Netbios Domain Name Sig

Jason Linden jlinden at ...2632...
Thu Jul 15 05:26:41 EDT 2004


We are having a problem with people plugging in personal computers onto our
network.  When opening up network Neighborhood and trying to browse to the
domain or workgroup, etc 'home123', it can't find any computers of course.
What I would like to do is setup a snort sig that will generate alerts on
packets from computers who broadcast their domain/workgroup name as
'home123'.  I am having a hard time getting the filter to work.  Anyone else
ever setup such a sig?
 
Thanks!
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20040715/8736c490/attachment.html>


More information about the Snort-sigs mailing list