Lovsan virus filter no available for Sniffer 2

[phaelon56]

http://download.nai.com/products/mcafee-avert/sniffer/Blaster Filters-081203.zip

Further info on the NAI homepage - this filter is compatible or designed for (so they claim) v4.3 Distributed or v4.75 Portable

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[lerdalt]

I looked at the filter from NAI, but am using the one modeled off of Laura Chappell's site. Quick to setup on finding Lovsan. Just does a data pattern filter for source and destination ports 4444. I modified the filter a bit, to also look for port 135 (blaster), and it looks like the new Sobig worm works of port 123 as well.

http://www.packet-level.com/library.htm

 

[bkirchoff]

is that port 123 tcp or udp or both

 

[lerdalt]

McAfee's website wasn't clear on that. I haven't investigated much beyond there.

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100561

 

[deeze6]

Hello phaelon56,

Just wondering what the link is to the main page for downloading more sniffer filters?

Thanks in advance!

 

[phaelon56]

I don't know of a specific page at NAI's web site where Sniffer virus filters can be downloaded. They've only released a few in the past couple years, Code Red and Blaster being among them. I've just sort of stumble across them or in some cases received an NAI email advising me that a new one was available (I've been to a bunch of Sniffer classes over the years and am on some kind of mailing list).

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[jrsavage]

You need to look at McAfee's web site for the specific virus. If there's a Sniffer filter available there will be a link to it in there. There is no master filter posted on Sniffer.com.

 

[phaelon56]

One of my customers found this page

http://www.networkassociates.com/us/security/resources/sv_home.htm#filte

Very helpful - I think all the available filters are here - scroll to the bottom of page to see them

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com