Snort mailing list archives

Bare byte alerts but no non-ASCII characters!


From: Julio Cesar Gazquez <jgazque0 () rosario gov ar>
Date: Thu, 21 Feb 2008 10:15:05 -0200

I'm looking at several "BARE BYTE UNICODE ENCODING" alerts, and wondering why 
are triggered, because as far as I understand it, it means there are 
non-ASCII, non percent encoded characters in the request.

However, all the bytes in the payload (at least as shown in BASE, and I don't 
have favorite suspects), are in the sub 0x80 range.

Any ideas about why this is happening? They aren't the only weird alerts I've 
got, but one of the most prevalent.

-- 
Julio César Gázquez
Seguridad Informática -- Int. 736
Municipalidad de Rosario

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: