Re: [Snort-inline-users] ares

[Norwich U. - I. S. <in...@no...>]

yes. The BES rules work great for alerting but the two based on  
"User-Agent\: Ares"
and the GET request do not block the connection or downloading. I have 
not tested
the uploading signiture, so I'm not sure how well that works.

Jason

Will Metcalf wrote:

>Did you try?
>
>http://www.bleedingsnort.com/bleeding-p2p.rules
>
>On 5/25/05, Norwich University - Information Security
><in...@no...> wrote:
>  
>
>>Hi,
>>
>>I've been trying for about 4 days to write a rule to drop ares
>>connections/downloads, but I'm having no success.
>>Has anyone successfully written a rule to block ares?
>>
>>Thx,
>>Jason
>>
>>
>>-------------------------------------------------------
>>SF.Net email is sponsored by: GoToMeeting - the easiest way to collaborate
>>online with coworkers and clients while avoiding the high cost of travel and
>>communications. There is no equipment to buy and you can meet as often as
>>you want. Try it free.http://ads.osdn.com/?ad_id=7402&alloc_id=16135&op=click
>>_______________________________________________
>>Snort-inline-users mailing list
>>Sno...@li...
>>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>
>>    
>>
>
>
>-------------------------------------------------------
>SF.Net email is sponsored by: GoToMeeting - the easiest way to collaborate
>online with coworkers and clients while avoiding the high cost of travel and
>communications. There is no equipment to buy and you can meet as often as
>you want. Try it free.http://ads.osdn.com/?ad_idt02&alloc_id135&op=click
>_______________________________________________
>Snort-inline-users mailing list
>Sno...@li...
>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>  
>