Full Disclosure mailing list archives
Re: Scan for IRC
From: Paul Schmehl <pauls () utdallas edu>
Date: Fri, 21 Jan 2005 21:47:24 -0600
--On Friday, January 21, 2005 5:34 PM -0600 RandallM <randallm () fidmail com> wrote:
You'll have a lot more success using something like snort or tcpdump to catch them. For example, you could easily write a couple of rules that would catch any IRC communications, regardless of the port used.I am so sorry for interrupting the list. I'm trying to pick up IRC communications on the network. I've made some filters for Ethereal and Observer but can't seem to pick it up. I'm doing something wrong. Used the 6668-6669 ports. Any help?
alert tcp $HOME_NET any -> any any (msg:"IRC communications"; content: JOIN; sid: 1000000; rev:1;) alert tcp $HOME_NET any -> any any (msg:"IRC communications"; content: PRIVMSG; sid: 1000001; rev:1;)
Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Scan for IRC RandallM (Jan 21)
- Re: Scan for IRC Athanasius (Jan 21)
- Re: Scan for IRC Oliver Leitner (Jan 21)
- RE: Scan for IRC Nikolay Baramov (Jan 21)
- Re: RE: Scan for IRC Frank Knobbe (Jan 21)
- RE: Scan for IRC Nikolay Baramov (Jan 21)
- Re: Scan for IRC Kevin (Jan 21)
- Re: Scan for IRC Jon Hart (Jan 21)
- Re: Scan for IRC Paul Schmehl (Jan 21)
- RE: Scan for IRC ALD, Aditya, Aditya Lalit Deshmukh (Jan 22)
- Re: Scan for IRC Harry Hoffman (Jan 22)