RE: Snort 1U Appliance for Sale on EBay

["Kreimendahl, Chad J" <Chad.Kreimendahl () umb com>]

I just had a funny thought to go with this spam.  I encourage others to
share theirs as well.

Being that I've never bothered with sales people that use the term
turn-key... Maybe it's time to write a snort rule to detect this. (This
machine probably does what it says... But still...)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Salesman BS Overflow
Detected"; pcre:"/turn[-\s]*key/i" classtype:"marketing-mumbojumbo";
sid:55378008; rev:1;)

Alternatively this rule could be switched around for source and
destination to detect when your sales people are using meaningless
mumbojumbo, etc...


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id56&alloc_id438&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users