From owner-freebsd-pf@FreeBSD.ORG  Wed Mar  2 21:49:40 2011
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 6A4EE106564A
	for <freebsd-pf@freebsd.org>; Wed,  2 Mar 2011 21:49:40 +0000 (UTC)
	(envelope-from neamtu@gmail.com)
Received: from mail-yw0-f54.google.com (mail-yw0-f54.google.com
	[209.85.213.54])
	by mx1.freebsd.org (Postfix) with ESMTP id 247E98FC17
	for <freebsd-pf@freebsd.org>; Wed,  2 Mar 2011 21:49:39 +0000 (UTC)
Received: by ywf9 with SMTP id 9so147791ywf.13
	for <freebsd-pf@freebsd.org>; Wed, 02 Mar 2011 13:49:39 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:mime-version:in-reply-to:references:date
	:message-id:subject:from:to:cc:content-type;
	bh=vnzxrZW2HS2Oly4V6P5/HXQ+9oOBR5yhLzMAHTSAV0c=;
	b=mIVZGgtFkuU6x2ynFMUYqCaoa9zxzd1C3RBT2FpNSyp8lIt5BOEtW9N7RN7s9feu1t
	1u3EyjM9+qtf+AhxKlKHTwfN92tJG5LQtaZPk/dgRjeEZyj+GkH+BUC4/4mPDoylGW2i
	uxEuRqr9NaB1ucAFrOu6VeMfDv1/kytV5/8pw=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:cc:content-type;
	b=YLrtFoT+gZDzK3Puh01N/CkcvpTgOUFEBEx9opCq9QENqKZ7dc4Yt+em4K6hTKZybv
	InBIMDdCKPC1OQlRXuOPBAXX4QQq4GBRvVLttS7RWgqKuYctViiJ/uftChhS3/9ehTlR
	PbAE+6BkY6zzlH5owZmfkUjMeLCYEK//+v/1s=
MIME-Version: 1.0
Received: by 10.90.3.35 with SMTP id 35mr28230agc.39.1299102579365; Wed, 02
	Mar 2011 13:49:39 -0800 (PST)
Received: by 10.90.70.11 with HTTP; Wed, 2 Mar 2011 13:49:39 -0800 (PST)
In-Reply-To: <4D6EB5BF.5040309@gmx.de>
References: <AANLkTinZk0zAXzp+13LknpZeQbAUbrC2gKEHVuzGcSFm@mail.gmail.com>
	<4D6EB5BF.5040309@gmx.de>
Date: Wed, 2 Mar 2011 23:49:39 +0200
Message-ID: <AANLkTik85bPrT52zZUiu3O3iuiB-Q=qTPNfgoobGKEb7@mail.gmail.com>
From: =?ISO-8859-1?Q?Richard_Brend=F6rfer?= <neamtu@gmail.com>
To: olli hauer <ohauer@gmx.de>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-Content-Filtered-By: Mailman/MimeDel 2.1.5
Cc: freebsd-pf@freebsd.org
Subject: Re: make pf to detect and drop virus/malware packets
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Mar 2011 21:49:40 -0000

This look interesting, thanks.

On Wed, Mar 2, 2011 at 11:25 PM, olli hauer <ohauer@gmx.de> wrote:

> On 2011-03-02 21:51, Richard Brend=F6rfer wrote:
> > Hi,
> > this is the first time when I write on mailing list.
> > If this subject was discussed in the past please don't shoot me, just
> trow
> > me a bone.
> >
> > I was wonder if pf can detect packets that match a signature/fingerprin=
t
> of
> > a virus, like it makes with the OS fingerprints.
> >
> > Let's assume that I start to download eicar then pf 'see' the signature
> of
> > the pachet(s) and drop the connection.
> > Is this possible ?
> >
>
> Not direct with pf, but in combination with snort and sortsam.
>