[Snort-users] Snort SMB

David Yip dy at ...6387...
Thu Aug 22 04:33:03 EDT 2002

I think he is asking about samba ALERT, i.e. a winpopup dialog box, i think.

At 18:31 22/8/2002, Sundström, Tomas wrote:

>pass udp $HOME_NET 137:138 <> $HOME_NET 137:138 (msg:"AcceptNetbios"; 
>you choose wheter you pass, alert, log, react to this match.
>This rule only applies on local "broadcasts" sent from windows mashines 
>but also for samba enabled servers.
>Rgds. Tomas
>-----Original Message-----
>From: Spangberg, Henrik 
>[<mailto:Henrik.Spangberg at ...6584...>mailto:Henrik.Spangberg at ...6584...] 
>Sent: den 22 augusti 2002 11:25
>To: Snort-Users (E-mail)
>Subject: [Snort-users] Snort SMB
>Does annybody now where to find inforamtion how to configure SNORT wtih smb
>Does SAMBA have to be installed?
> >>No
>Most kind regards Henrik
>This email and any files transmitted with it are confidential and
>intended solely for the use of the individual or entity to whom they
>are addressed. If you have received this email in error please notify
>the sender either by telephone or by e-mail and delete the material
>from any computer. Thank you for your cooperation.
>This footnote also confirms that this email message has been swept by
>MIMEsweeper for the presence of computer viruses.
>This sf.net email is sponsored by: OSDN - Tired of that same old
>cell phone?  Get a new here for FREE!
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:


David Yip
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020822/14ba20fa/attachment.html>

More information about the Snort-users mailing list