[Snort-users] Flamebait

Jason Lewis jlewis at ...2449...
Tue Feb 12 19:04:02 EST 2002


Yeah, I am putting the suit on now.  I remember a rule for logging AIM
traffic but I can't find it anywhere.  All I can find in the archives is
this:

alert tcp $EXTERNAL_NET 5190 -> $HOME_NET 1024: (msg:"AOL Instant Messager -
Inbound"; content:"|2A 02|"; offset:0; depth:2; fragbits:D;)
alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 5190 (msg:"AOL Instant Messager -
Outbound"; content:"|2A 02|"; offset:0; depth:2; fragbits:D;)

And this isn't that great.  Does anyone have an AIM sig?  Or is it too
difficult to write for?

jas





More information about the Snort-users mailing list