Re: GET /.hash=

[Jens Krabbenhoeft <tschenz-snort-users () noris net>]

Hi,

> 63.188.225.202 - - [02/Dec/2002:03:21:52 -0600] "GET 
> /.hash=c53afc03d9fbdd5ffd2e7fed919ee6ff9f2633cb HTTP/1.1" 416 385

Have a look at following thread:
http://marc.theaimsgroup.com/?l=snort-sigs&m=103702384305029&w=2

There is one mail on snort-sigs that says that 'GET /.hash=' seems to be
the signature of Kazaa Desktop 2. Haven't seen such packets yet, so I
don't know if that's true or not ;).

HTH,
        Jens


-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T 
handheld. Power & Color in a compact size! 
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users