erek at ...950...
Tue Jan 21 21:17:02 EST 2003
On Wed, 22 Jan 2003, Semerjian, Ohanes wrote:
> There is another way of achieving ur goal and that is by writing a rule
> something like
> alert tcp employee_IP_address any -> dest_IP 25 (msg:"whatever u whant";)
Keep it simple.
snort -b "host evil.employee.com and port 25"
Don't make it more difficult that it needs to be.
Make your life even simpler: mailsnarf--It's part of the dsniff tools
Also check the archives, as this was recently discussed....
"When things get weird, the weird turn pro." H.S. Thompson
More information about the Snort-users