Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Custom Sig

How do I create a sig to capture passwords? We are wanting to limit our clients from passing information from inside of our network to the outside.

New Member

Re: Custom Sig

Signature for capturing passwords is specific to the protocol that is being used. Some protocols (anything encrypted) are impossible to catch passwords, others are quite easy (ie. ftp, telnet, etc.).

Let's use ftp as an example. To capture the password you could right a signature with a RegexString of "[Pp][Aa][Ss][Ss].*[\r\n]" and a ServicePorts of 21. This would alarm when anyone logs into an ftp server. You could set a filter to filter out all IN->IN traffic. This would also have the side effect of displaying the password in the context data (if that is what you meant about catching).

New Member

Re: Custom Sig

Yes, that is what I ment. I will try http first and see what I get?

CreatePlease to create content