Re: IIS Unicode attack

[Neil Dickey <neil () geol niu edu>]

"moran" <Moran () TIEMiddleEast com> wrote asking:

> Is there a way I can tell snort Ignore the Unicode attack checking to this
> specific host?

Not as far as I know.  You can only turn off the unicode alerts generally
by using the "-unicode" option for the appropriate preprocessor:

  preprocessor http_decode: 80 8080 -unicode

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users