jlewis at ...2449...
Tue Feb 12 19:04:02 EST 2002
Yeah, I am putting the suit on now. I remember a rule for logging AIM
traffic but I can't find it anywhere. All I can find in the archives is
alert tcp $EXTERNAL_NET 5190 -> $HOME_NET 1024: (msg:"AOL Instant Messager -
Inbound"; content:"|2A 02|"; offset:0; depth:2; fragbits:D;)
alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 5190 (msg:"AOL Instant Messager -
Outbound"; content:"|2A 02|"; offset:0; depth:2; fragbits:D;)
And this isn't that great. Does anyone have an AIM sig? Or is it too
difficult to write for?
More information about the Snort-users