Full Disclosure mailing list archives
Snort on a Bootable FreeBSD CD to catch Nachi, Blaster & Sobig
From: Justin Tan <justin.tan () extol com my>
Date: Thu, 04 Sep 2003 21:08:30 +0800
On Thu, 2003-09-04 at 20:45, Paul Schmehl wrote:
Just curious - what sigs are you using for detection?
Nachi & Sobig.F - by you, Paul Schmehl(pauls () utdallas edu). Msblaster by Brian Caswell <bmc () sourcefire com> & Nigel Houghton <nigel.houghton () sourcefire com> (http://www.snort.org/snort-db/sid.html?sid=2192) Nachi and Sobig.F tested, works fine. Great job there. Only problem is with a possible false positive (Sobig.F sig) with Crystal Reports listening oo port 8998. Justin. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Snort on a Bootable FreeBSD CD to catch Nachi, Blaster & Sobig Justin Tan (Sep 04)