Re: [Snort-sigs] MP3 Signature

From: <bfdi533(at)cbacc-security3.bus.utexas.edu>
Date: Mon Mar 17 2003 - 18:00:28 EST

> > > The file utility on Solaris says that my 48 test mp3 files are either
> > > "data","commands text", "ascii text" or "English text". This isn't very
> > > helpful.
> >
> > Try with a tool that you have the source for. On linux it gets all of them
> > right. Including the specific MP3 characteristics.
>
> Guys, I think you're missing something here. You need something that can

I believe the point of the "file" utility source code was that it does a good job of identifying the MP3 file. So, go look in the source code for that utility (I know the Linux version is good and up-to-date) and see what it is using for a "signature" for the MP3 file. Then use this in your snort sig.

Ed Davison

---

This SF.net email is sponsored by: Does your code think in ink? You could win a Tablet PC. Get a free Tablet PC hat just for playing. What are you waiting for?
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Tue Mar 18 08:22:22 2003