[Snort-sigs] Witty signature

Russell Fulton r.fulton at ...575...
Sat Mar 20 23:07:02 EST 2004


On Sun, 2004-03-21 at 00:17, todb at ...794... wrote:
> Pretty easy one:
> 
> alert udp any 4000 -> any any (msg:"ISS RealSecure or BlackICE Witty

According to Symantec they are seeing some udp packets containing the
worm with source ports other than 4000.

-- 
Russell Fulton                                    /~\  The ASCII
Network Security Officer                          \ /  Ribbon Campaign
The University of Auckland                         X   Against HTML
New Zealand                                       / \  Email!






More information about the Snort-sigs mailing list