Re: Can snort detect covert channels?

[Mouza Al-Nayeli <mouza.alnayeli () gmail com>]

Hello Nigel

TCP/IP header covert channels, ICMP covert channels, DNS covert channels,
packet sorting covert channels.


2009/10/4 Nigel Houghton <nhoughton () sourcefire com>

> On Sun, Oct 4, 2009 at 6:04 AM, Mouza Al-Nayeli
> <mouza.alnayeli () gmail com> wrote:
> > Hi folks,
> >
> > I’m kind of new to the snort world and I hope that I find some good
> answers
> > to my question. I googled a lot but the results were not satisfactory!
> >
> > Can snort detect covert channels? if yes, can someone supply me with the
> > appropriate articles, examples, references that might help me understand
> how
> > this could happen?
> >
> > Thanks in advance,
> >
> > --
> > Mouza A. Al-Nayeli
> > -----------------------------------------------
> > There comes a time when the mind takes a higher plane of knowledge but
> can
> > never prove how it got there
> ------------------------------------------------------------------------------
> > Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
> > is the only developer event you need to attend this year. Jumpstart your
> > developing skills, take BlackBerry mobile applications to market and stay
> > ahead of the curve. Join us from November 9&#45;12, 2009. Register
> now&#33;
> > http://p.sf.net/sfu/devconf
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> What kind of covert channels do you have in mind?
>
> --
> Nigel Houghton
> Head Mentalist
> SF VRT
> http://vrt-sourcefire.blogspot.com && http://www.snort.org/vrt/



-- 
Mouza A. Al-Nayeli
-----------------------------------------------
There comes a time when the mind takes a higher plane of knowledge but can
never prove how it got there

------------------------------------------------------------------------------
Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
http://p.sf.net/sfu/devconf

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users