[Snort-users] Snort and Kazaa 2.0
fknobbe at ...652...
Tue Oct 22 20:53:02 EDT 2002
On Tue, 2002-10-22 at 20:03, Sam Evans wrote:
> Based on what we have seen, it no longer uses the 1214 port for it's
> traffic. (Although, it does use it sometimes.. ) Wierd.
> Anyway, we have come up with a rule that seems to work very well for the new
> Kazaa. YMMV though..
> This is for snort 1.8.7 (but should work for 1.9.0).
> alert tcp any any -> any any (msg: "P2P Kazaa File Transfer"; content:
> "X-Kazaa"; rev: 1;)
> What we have seen, is that even though the new Kazaa doesn't use the
> standard 1214, the protocol still utilizes the X-Kazaa tag for it's
> transfers. While this rule will not alert you as to when someone is
> searching for a file, it will alert when someone initiates a transfer
> session. (Multiple times quite possibly, depending on the packet).
Can you define an offset or some other characteristic that would avoid
false positives? I mean, this email alone would trigger that rule... :)
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 307 bytes
Desc: This is a digitally signed message part
More information about the Snort-users