RE: snort rule for vmware

["Jim Hendrick" <jrhendri () maine rr com>]

No "rules" but (unless the user has changed it) they use a default MAC
address prefix that should be easy to spot.

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Christopher
Stack
Sent: Thursday, February 24, 2005 7:03 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] snort rule for vmware


any rules for finding vmware nics?