> [1] http://www.cisco.com/en/US/products/ps6723/products_white_paper0900aecd80633b0a.shtml
Thank you for that link, i didn't know skype had a fixed value when it connected.. http://www.securityfocus.com/infocus/1531 tells you how you can filter for strings in your payload, but you need to enable string support in IPTables. I guess you could trap for that 0x17030100 word then. -- mh
