[Ethereal-users] Sniffing for Viruses

["Nick J Marques" <Nick.Marques@xxxxxxxxxxxxxxxxxxxxxxx>]

Hey can I use Ethereal to sniff for virus traffic on a network?? I can currently using the succession of ARP Requests from the same host to consecutive IPs as an indication of RPC works like Welchia… Is this method fool-proof.. what else might send out packets like that?? I ask because I am still seeing these packets on a system I know was patched and cleaned out…

 

What are some other filters I can use for virus traffic??

 

Thanks