[Snort-users] Snort and Kazaa 2.0

Frank Knobbe fknobbe at ...652...
Tue Oct 22 20:53:02 EDT 2002


On Tue, 2002-10-22 at 20:03, Sam Evans wrote:
> Based on what we have seen, it no longer uses the 1214 port for it's
> traffic.  (Although, it does use it sometimes.. )  Wierd.
> 
> Anyway, we have come up with a rule that seems to work very well for the new
> Kazaa.   YMMV though..
> 
> This is for snort 1.8.7 (but should work for 1.9.0).
> 
> alert tcp any any -> any any (msg: "P2P Kazaa File Transfer"; content:
> "X-Kazaa"; rev: 1;)
> 
> What we have seen, is that even though the new Kazaa doesn't use the
> standard 1214, the protocol still utilizes the X-Kazaa tag for it's
> transfers.  While this rule will not alert you as to when someone is
> searching for a file, it will alert when someone initiates a transfer
> session.  (Multiple times quite possibly, depending on the packet).


Can you define an offset or some other characteristic that would avoid
false positives? I mean, this email alone would trigger that rule... :)

Regards,
Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 307 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20021022/d3d1665e/attachment.sig>


More information about the Snort-users mailing list