Snort mailing list archives
Re: WEB-CLIENT Excel malformed FBI record - False positive?
From: Jack Pepper <pepperjack () afferentsecurity com>
Date: Tue, 08 Jul 2008 09:16:33 -0500
Interesting. This implies a malfunction of some sort. This rule could not fire off on that packet. Perhaps the config is not what it seems. You had said that EXTERNAL_NET was !HOME_NET, so this is impossible. Check the config file for accuracy, or check that the snort service is using the same config file that you think it's using. jp -- Framework? I don't need no stinking framework! ---------------------------------------------------------------- @fferent Security Labs: Isolate/Insulate/Innovate http://www.afferentsecurity.com ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 07)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jack Pepper (Jul 07)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? List Subscriptions (Jul 07)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jack Pepper (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jack Pepper (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Joel Esler (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jack Pepper (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 09)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Joel Esler (Jul 09)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jack Pepper (Jul 08)