[Snort-users] About virus.rules

Michael Sconzo msconzo at ...5072...
Mon May 17 14:55:01 EDT 2004


> No, actually... it's because you're worthless... hehe  ;)

My worst fear has come true *cry*. :)

> So basically, remove virus.rules or trim it to only to those that also
> spread through the network (hybrids), but create and maintain a
> worm.rules file.

Similiar to what we do around here at TAMU for the 40+ snort boxes
we have out in the wild.  I figued it would be a benefit to most
people (especially .edu's) that are trying to be good 'net neighbors
to everybody else, due to the nature of our user base.  

I try to monitor the snort-sigs list and a few other places to try
and keep up with worm rules, due to problems they cause around here.
Figured it might be a good way to help give back...but oh well.

I still wouldn't mind doing it offically or unoffically ... 

-=Mike

-- 
The New Testament offers the basis for modern computer coding theory,
in the form of an affirmation of the binary number system.
        But let your communication be Yea, yea; nay, nay: for
        whatsoever is more than these cometh of evil.
                -- Matthew 5:37




More information about the Snort-users mailing list