Re: Rules for detecting spyware

[Brian <bmc () snort org>]

On Mon, Aug 11, 2003 at 09:54:49AM -0500, Marc Quibell wrote:
> I've done a little checking, so far no luck. I wonder if it's possible to setup
> some Snort rules for detecting spyware data. I'll keep looking for the actual
> data content of such packets, but does anyone already have some rules? TIA!

Sure its possible to detect spyware.  Do we do it currently?  Nope.  But 
thats cause I don't have packet captures for it.  The easiest method for 
finding packets is to install the spyware in question, then sit back
and watch.  :)

-brian


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users