[Snort-users] Capturing FTP/POP3/IMAP/SMTP banners

Mayers, Philip J p.mayers at ...1913...
Thu Apr 26 12:09:15 EDT 2001


I shouldn't be surprised :o)

Is this in 1.7 or 1.8?

Regards,
Phil

+----------------------------------+
| Phil Mayers, Network Support     |
| Centre for Computing Services    |
| Imperial College                 |
+----------------------------------+  

-----Original Message-----

<snip>

Yeap, thats already been added into snort.

alert any any -> $HOME_NET 21 (msg:"FLAGED FTP SESSIONS INCOMING";
flags:s; tag: session,150,bytes;)

-- 
Brian Caswell
The MITRE Corporation




More information about the Snort-users mailing list