[Snort-users] Help

Erek Adams erek at ...950...
Tue Jan 21 21:17:02 EST 2003

On Wed, 22 Jan 2003, Semerjian, Ohanes wrote:

> There is another way of achieving ur goal and that is by writing a rule
> something like
> alert tcp employee_IP_address any -> dest_IP 25 (msg:"whatever u whant";)

Keep it simple.

snort -b "host evil.employee.com and port 25"

Don't make it more difficult that it needs to be.

Make your life even simpler:  mailsnarf--It's part of the dsniff tools

Also check the archives, as this was recently discussed....


Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson

[0]	http://naughty.monkey.org/~dugsong/dsniff/

More information about the Snort-users mailing list