El vie, 24 de 09 de 2004 a las 09:40, Chich Thierry escribiÃ:
Hello,
I am just reading the rules 2000330-2000333 proposed in the
bleeding-edge ruleset.
I believe it is a mistake to limit the destination ports to 4660:4799.
A lot of edonkey server are using other ports. If you use the rules only
for detection, it is enough, because edonkey clients will use a list of
servers
that will contain servers using the classical ports.
But if you are using these rules in order to kill the connections, the
efficiency will be greatly
improved by using any instead of 4660:4799.
Thierry
I agree with you, the best approach should be the one that use any
port and checks for edonkey signature, because edonkey can use many
ports to connect to it's networks. It would better even to use
snort-inline if you want to stop it, but as the rules are in the
bleeding-edge group it maybe it's a little risky.
--
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÃA
The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
