[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-sigs
Subject:    RE: [Snort-sigs] Kazaa/Morpheus/Fastrack protocol policy rule
From:       "Workman, Matthew" <Matthew.Workman () us ! wmmercer ! com>
Date:       2001-12-13 13:58:24
[Download RAW message or body]


Thank you... I have never tried writing snort rules yet, but I know how to
use them ... hehe.  I added this one, and thank you.  =)

-----Original Message-----
From: Chris Green [mailto:cmg@uab.edu]
Sent: Wednesday, December 12, 2001 5:26 PM
To: snort-sigs
Subject: [Snort-sigs] Kazaa/Morpheus/Fastrack protocol policy rule


Just because I'm sure some people would like it since it's the popular
one now.  

alert tcp any any -> $HOME_NET 1214 \
(msg: "FastTrack Protocol (Morpheus/Kazaa) GET request"; \
 content: "GET "; depth: 4; flags:A+; \
 reference: url, www.musiccity.com/technology.htm; \
 reference: url, www.kazaa.com; )
 
-- 
Chris Green <cmg@uab.edu>
Fame may be fleeting but obscurity is forever.

_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs


----------------------------------------------------------------------------

This e-mail and any attachments may be confidential or legally privileged.
If you received this message in error or are not the intended recipient, you
should destroy the e-mail message and any attachments or copies, and you are
prohibited from retaining, distributing, disclosing or using any information
contained herein.  Please inform us of the erroneous delivery by return
e-mail. 

Thank you for your cooperation.

----------------------------------------------------------------------------



_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[prev in list] [next in list] [prev in thread] [next in thread]