Flamebait

["Jason Lewis" <jlewis () packetnexus com>]

Yeah, I am putting the suit on now.  I remember a rule for logging AIM
traffic but I can't find it anywhere.  All I can find in the archives is
this:

alert tcp $EXTERNAL_NET 5190 -> $HOME_NET 1024: (msg:"AOL Instant Messager -
Inbound"; content:"|2A 02|"; offset:0; depth:2; fragbits:D;)
alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 5190 (msg:"AOL Instant Messager -
Outbound"; content:"|2A 02|"; offset:0; depth:2; fragbits:D;)

And this isn't that great.  Does anyone have an AIM sig?  Or is it too
difficult to write for?

jas


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users