Hi all Please find the class-map presen in the following link for identifying the code red worm.
http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186a00800fc176.shtml Router(config)#*class-map match-any http-hacks* Router(config-cmap)#*match protocol http url "*default.ida*"* Router(config-cmap)#*match protocol http url "*cmd.exe*"* Router(config-cmap)#*match protocol http url "*root.exe*"* ** *Isn't the following correct?* ** Router(config)#*class-map match-any http-hacks* Router(config-cmap)#*match protocol http url ".*default.ida.*"* Router(config-cmap)#*match protocol http url ".*cmd.exe.*"* Router(config-cmap)#*match protocol http url ".*root.exe.*"* ** ** *With regards* *Kings*
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
