[Snort-users] Snort SMB

"Sundström, Tomas" Tomas.Sundstrom at ...6671...
Thu Aug 22 03:33:04 EDT 2002


pass udp $HOME_NET 137:138 <> $HOME_NET 137:138 (msg:"AcceptNetbios";

you choose wheter you pass, alert, log, react to this match.
This rule only applies on local "broadcasts" sent from windows mashines but
also for samba enabled servers.

Rgds. Tomas

-----Original Message-----
From: Spangberg, Henrik [mailto:Henrik.Spangberg at ...6584...]
Sent: den 22 augusti 2002 11:25
To: Snort-Users (E-mail)
Subject: [Snort-users] Snort SMB

Does annybody now where to find inforamtion how to configure SNORT wtih smb
Does SAMBA have to be installed?

Most kind regards Henrik

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender either by telephone or by e-mail and delete the material
from any computer. Thank you for your cooperation.

This footnote also confirms that this email message has been swept by
MIMEsweeper for the presence of computer viruses.


This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020822/ec687d40/attachment.html>

More information about the Snort-users mailing list