[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-Disclosure] Snort on a Bootable FreeBSD CD to catch Nachi, Blaster & Sobig
- To: full-disclosure@xxxxxxxxxxxxxxxx
- Subject: [Full-Disclosure] Snort on a Bootable FreeBSD CD to catch Nachi, Blaster & Sobig
- From: Justin Tan <justin.tan@xxxxxxxxxxxx>
- Date: Thu, 04 Sep 2003 21:08:30 +0800
On Thu, 2003-09-04 at 20:45, Paul Schmehl wrote:
>Just curious - what sigs are you using for detection?
Nachi & Sobig.F - by you, Paul Schmehl(pauls@xxxxxxxxxxxx).
Msblaster by Brian Caswell <bmc@xxxxxxxxxxxxxx> & Nigel Houghton
<nigel.houghton@xxxxxxxxxxxxxx>
(http://www.snort.org/snort-db/sid.html?sid=2192)
Nachi and Sobig.F tested, works fine. Great job there. Only problem is
with a possible false positive (Sobig.F sig) with Crystal Reports
listening oo port 8998.
Justin.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html