Custom Signature for Social Security Numbers

[mike_jones]

I am currently running an IDS-4235 Build Version: 5.1(4)S271.0. I need to create a custom signature that will alert when it detects social security numbers passing in the clear.

Can anyone lend a hand on how to create this signature or point me to any resources that would help?

Thanks in advance.

[mhellman]

Here's an example of a regular expression:

http://regexlib.com/REDetails.aspx?regexp_id=539

the next question is where do you want to look for it (HTTP, SMTP, etc). You'll probably need to create individual signatures for each protocol.