[Snort-users] Oinkmaster and 1394

James Lay jlay at ...13475...
Sun Aug 10 09:49:08 EDT 2008


So I know there¹s a way to do this...I¹ve seen it posted here before but for
the life of me I can¹t find the posting.

I get a lot of FP¹s with sid 1394 (shellcode) on port 25.  What¹s the way to
use oinkmaster to mofidysid to change the second occurrence of ²any² to
³!25²?  Thanks all!

James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20080810/663f97e1/attachment.html>


More information about the Snort-users mailing list