[Snort-users] Help

Erek Adams erek at ...950...
Tue Jan 21 21:17:02 EST 2003


On Wed, 22 Jan 2003, Semerjian, Ohanes wrote:

> There is another way of achieving ur goal and that is by writing a rule
> something like
>
> alert tcp employee_IP_address any -> dest_IP 25 (msg:"whatever u whant";)

Keep it simple.

snort -b "host evil.employee.com and port 25"

Don't make it more difficult that it needs to be.

Make your life even simpler:  mailsnarf--It's part of the dsniff tools
[0].

Also check the archives, as this was recently discussed....

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


[0]	http://naughty.monkey.org/~dugsong/dsniff/




More information about the Snort-users mailing list