[Snort-sigs] Witty signature
r.fulton at ...575...
Sat Mar 20 23:07:02 EST 2004
On Sun, 2004-03-21 at 00:17, todb at ...794... wrote:
> Pretty easy one:
> alert udp any 4000 -> any any (msg:"ISS RealSecure or BlackICE Witty
According to Symantec they are seeing some udp packets containing the
worm with source ports other than 4000.
Russell Fulton /~\ The ASCII
Network Security Officer \ / Ribbon Campaign
The University of Auckland X Against HTML
New Zealand / \ Email!
More information about the Snort-sigs