[Snort-users] GET /.hash=

Jens Krabbenhoeft tschenz-snort-users at ...7018...
Tue Dec 3 00:01:11 EST 2002


Hi,

> 63.188.225.202 - - [02/Dec/2002:03:21:52 -0600] "GET 
> /.hash=c53afc03d9fbdd5ffd2e7fed919ee6ff9f2633cb HTTP/1.1" 416 385

Have a look at following thread:
http://marc.theaimsgroup.com/?l=snort-sigs&m=103702384305029&w=2

There is one mail on snort-sigs that says that 'GET /.hash=' seems to be
the signature of Kazaa Desktop 2. Haven't seen such packets yet, so I
don't know if that's true or not ;).

HTH,
	Jens




More information about the Snort-users mailing list