Snort mailing list archives
Apache Whitespace and Bare Byte Unicode Encoding
From: Lane LiaBraaten <lliabraa () isrparc org>
Date: Wed, 24 Mar 2004 08:59:24 -0500
I am running snort 2.1.0 outside my firewall. I received about 7,000 Apache Whitespace alerts and 14,000 Bare Byte alerts last night. The packets were destined for several different IPs all on port 80. So it seems like one of the computers inside my network was sending out data, but I can't tell which one because my sensor is outside the firewall. Does anyone recognize this behavior? TIA, LGL ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Apache Whitespace and Bare Byte Unicode Encoding Lane LiaBraaten (Mar 24)