RE: Nimda: Rules

["Gercken, Bill Mr SIGNAL" <bill.gercken () nvl army mil>]

Brian,

Have a look at: 

netbios.rules

also make sure they are enabled in your snort.conf.

Regards,
-bill

> -----Original Message-----
> From: Brian Ertel [mailto:bsertel () amherst edu]
> Sent: Tuesday, July 09, 2002 10:10 AM
> To: Snort (E-mail)
> Subject: [Snort-users] Nimda: Rules
>
>
> Hello All,
>
> Does anyone have any rules for effectively detecting Nimda?
>
> Regards
>
> ----------------------------------
> Brian Ertel
> Systems & Networking
> Network Administrator
> Amherst College
> Voice: 413-542-8320
> Fax:    413-542-2626
> bsertel () amherst edu
> ----------------------------------
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Stuff, things, and much much more.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Stuff, things, and much much more.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Stuff, things, and much much more.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users