[Guy Harris <guy@xxxxxxxxxxxx>]

On Feb 6, 2004, at 3:03 AM, Bergweiler, Christian (ATS Amsterdam) wrote:

> Here http://marc.theaimsgroup.com/?l=snort-sigs&m=103401931132259&w=2
> seems to be a full capture, and here there's lot of info (i. e.
> signatures):
> http://marc.theaimsgroup.com/?l=snort-sigs&w=2&r=1&s=bugbear&q=b
>
> Maybe googling for +snort +bugbear will give you some direct
> packet-level signature to look for...

And googling just for "snort" would show you

	http://www.snort.org/

which is the home page for a program that might be a better tool for 
detecting viruses and other network intrusions than is Ethereal (as 
Snort was designed to be an intrusion detector that runs in the 
background, while Ethereal was designed to be a network analyzer to let 
humans look at captures).

Another free-software IDS is Prelude:

	http://www.prelude-ids.org/