Re: [Ethereal-users] looking for virus or spamming

["Tom Greaser" <tgreaser@xxxxxxxxxxx>]

can try looking for all dns request that do NOT have an A or PRT record
you can compair to some black hole files
 
 
>>>jlmiller@xxxxxxxxxxxxxxxxxx 12/04/05 8:06 pm >>> 
I'm currently looking at a gateway server that seems to have a awful lot
of DNS requests and ARP requests.  Not sure if this is correct, but is
there a way to home in on virus and spam checking?  I eliminate all
valid traffic, but I would like to know if there are certain packets I
can look for.  I know this is huge area, if there is something I can
look for trim the search I would appreciate it. 
 
Thanks 
 
Jon 
 
 
Ethereal-users mailing list 
Ethereal-users@xxxxxxxxxxxx 
http://www.ethereal.com/mailman/listinfo/ethereal-users