Custom signatures

[HoratioE]

Could someone please direct me on how to create a new signature? Right now I only need to be able to block packets starting with 5 or so specific characters in the data and then the rest will be dynamic content/length.

Thanks!

[bigdessert]

I am pretty sure the default ruleset for signatures comes from here, so this might be a good place to start.
http://l7-filter.sourceforge.net/

[HoratioE]

I'm finding this to be a little confusing. Does anyone have a quick template that can do what I need?

Thanks

[RatKnight]

Honestly, you need to download the "l7-protocols-2009-05-28" file. Under "protocols" you will have a listing of .pat files. Open them with Notepad++, and take a look. It will give you the pattern, etc. You just go into your untange server, add one, and put in that information... Honestly though, the current is probably based off of this tanyhow... so... yea.

[dmorris]

The signatures are just regex. Do some googling and you'll find some regex tutorials about how to write regexs and you can just write your own fairly easily.