Re: Limewire

[rottz () securityflaw com]

Joe Lawson wrote:
> Greetings:
>
> Has anyone captured a Limewire session and developed a Snort rule to detect
> this specific variant of Gnutella?
Check out policy.rules line 23-26 which are generic GNUTella connect
rules which catch all Limewire connections.

Do you really need to specify limewire from other gnutella clients?
If so, I have some packet captures which I could try to develop more
"specific" rules if you want.

Peter
-- 
rottz at securityflaw dot com
Founder of Securityflaw

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users