[Snort-sigs] dropping traffic

From: Esler, Joel Contractor <EslerJ(at)RCERT-S.ARMY.MIL>
Date: Wed May 28 2003 - 09:52:17 EDT

pass $SMTP_SERVERS any -> $EXTERNAL_NET any (msg:"Traffic dropper";

content????????????????????????

What would I write to be able to drop all traffic from the email server
(filter it out basically).... or what could I write to trigger an IP?
(both ways I am asking)....

alert <IP here> any -> $HOME_NET (msg:"<IP here> connection event"; content:"%20";)

or something??

J

---

This SF.net email is sponsored by: ObjectStore. If flattening out C++ or Java code to make your application fit in a relational database is painful, don't do it! Check out ObjectStore. Now part of Progress Software. http://www.objectstore.net/sourceforge

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Wed May 28 10:51:02 2003