[Snort-users] SUMMARY, CyberKit 2.2 Ping, its driven me Nuts..

Jeff Kell jeff-kell at ...6282...
Wed Dec 31 06:41:01 EST 2003

Chris N wrote:

> Fellowship of the Snort,
> I guess I should have clarified that all the "CyberKit 2.2 Ping" alerts were
> ingress only.
> Some of you guys suggested just removing the alert. Yes that would stop the
> chaos, but I didn't want to blind myself. Although, I do have to admit I was
> leaning this way.

Is there a way to distinguish CyberKit 2.2 from Nachi?  Nachi is always 
64 bytes of 0xaa, is CyberKit's the same length?


More information about the Snort-users mailing list