Snort mailing list archives

RE: Snort 1.7 MySQL Question


From: "Johnson, David" <DJohnson () IronMountain com>
Date: Fri, 10 Aug 2001 18:05:56 -0400

It's fairly easy to decode:

Simply plug the number into your scientific calculator and convert it to
binary like so:

1077562595 --> 1000000001110100100110011100011

Then split the binary number into 8-bit octets like so:

01000000.00111010.01001100.11100011 (start from the right and if you need
extra digits for the leftmost octet, add 0's)

Now convert the individual octets into decimal:

64.58.76.227

Just do it backwards to "encrypt" your IP address...

-----Original Message-----
From: Jason [mailto:jason () tcpipbitch net]
Sent: Friday, August 10, 2001 2:30 PM
To: bthaler () webstream net
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Snort 1.7 MySQL Question



Actually, funny enough, browsers will work with this as well, spammers
like to use it to hide the web sites they are sending you to. they use
things like www.hotmail.com@1064298128/blah/blah.html

Off hand I cannot remember how to decode it, however if you goto
www.samspade.org there are some tools there

Jason

 On Fri, 10 Aug  2001 bthaler () webstream net wrote:


My machine knows how to decode these.  For instance, I can ping
"1064298128"
from a command line.  But I'm not as smart as my machine, LOL.

Appreciate any help,
Brad T.


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: