[Ethereal-users] Sniffing for Viruses

[Nick Marques]

Hey can I use Ethereal to sniff for virus traffic on a network?? I can currently using the succession of ARP Requests from the same host to consecutive IPs as an indication of RPC works like Welchia… Is this method fool-proof.. what else might send out packets like that?? I ask because I am still seeing these packets on a system I know was patched and cleaned out…   What are some other filters I can use for virus traffic??   Thanks