Snort mailing list archives
thank you-> Does Signature exist alert on DNS queries to a nameserver.
From: "Jacob, Raymond A Jr" <raymond.jacob () navy mil>
Date: Tue, 7 Mar 2006 16:13:50 -0500
thank you, Raymond Message: 4 From: Zultan <zultan () mad scientist com> To: "Jacob, Raymond A Jr" <raymond.jacob () navy mil>, snort-users () lists sourceforge net Date: Mon, 06 Mar 2006 20:59:14 +0000 Subject: Re: [Snort-users] Does Signature exist alert on DNS queries to a nameserver. Here's the basic syntax. Note the hex number between the pipes. It is the = count of the number of following ASCII bytes. For example, freebeertoday.c= om would be |0d|freebeertoday|03|com alert udp $HOME_NET any -> $DNS_SERVERS 53 (msg:"amazon.com DNS query"; con= tent:"|06|amazon|03|com"; nocase;) Sensor placement is critical for this to work. The senosr must be able to = see the desktop ask its nameserver(s). Zultan ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- thank you-> Does Signature exist alert on DNS queries to a nameserver. Jacob, Raymond A Jr (Mar 07)