Ethereal-users: [Ethereal-users] Sniffing for Viruses

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Nick J Marques" <Nick.Marques@xxxxxxxxxxxxxxxxxxxxxxx>
Date: Mon, 3 Nov 2003 23:48:01 -0600

Hey can I use Ethereal to sniff for virus traffic on a network?? I can currently using the succession of ARP Requests from the same host to consecutive IPs as an indication of RPC works like Welchia… Is this method fool-proof.. what else might send out packets like that?? I ask because I am still seeing these packets on a system I know was patched and cleaned out…

 

What are some other filters I can use for virus traffic??

 

Thanks