Ray Burkholder -----Original Message----- From: McDonald, Dan [mailto:[EMAIL PROTECTED]] Sent: January 25, 2003 17:05 To: '[EMAIL PROTECTED]' Subject: [flow-tools] w32.sqlexp.worm In case anyone needs it, here is the flow-tools nfilter that I've found to match the worm that hit us... filter-primitive mssql type ip-port permit 1434 default deny filter-primitive wormsize type counter permit eq 404 default deny filter theworm match src-ip-port mssql match octets wormsize that with a flow-print -f 5 gave me the time of the first infection... Daniel J McDonald, CCIE #2495, CNX Lan/Wan Integrator Austin Energy 1.512.322.6739 [EMAIL PROTECTED] _______________________________________________ [EMAIL PROTECTED] http://www.splintered.net/sw/flow-tools
