Re: Software that scans for SSN

[Ramon Hermida <RHERMIDA () PANAM EDU>]

We did not notice much of a CPU spike on our systems.  When it comes to false positives, we get a relatively small 
number (maybe 10-15 alerts for the entire week).

> In fact, there are a few snort rules for SSNs/CCs; check the rulesets at
> bleedingsnort.com, specifically bleeding-policy.rules, sids
> 2001375-2001383.

For the guys who've tried the snort SSN sigs - what kind of results did
you get?

We loaded *only* the SSN sigs, and the cpu spiked to 99% and dropped
most of the packets on the wire. Have you guys really been getting
different results?