[Snort-sigs] edonkey rules

Hello,

I am just reading the rules 2000330-2000333 proposed in the 
bleeding-edge ruleset.

I believe it is a mistake to limit the destination ports to 4660:4799.
A lot of edonkey server are using other ports.  If you use the rules only
for detection, it is enough, because edonkey clients will use a list of 
servers
that will contain servers using the classical ports.

But if you are using these rules in order to kill the connections, the 
efficiency will be greatly
improved by using any instead of 4660:4799.

Thierry


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs