Snort mailing list archives
http_inspect
From: "Jefferson, Shawn" <Shawn.Jefferson () bcferries com>
Date: Tue, 10 Nov 2009 11:32:40 -0700
Hi, I'm looking at tuning the http_inspect pre-processor, specifically some of the false positives I get from this. My question is, if you set some of these options: u_encode no bare_byte no iis_unicode no double_decode no Will that affect the ability for snort to process some of the http specific rules in the ruleset? Does it affect the normalization of http traffic, or just turn off these specific alerts? -- Shawn
------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- http_inspect Jefferson, Shawn (Nov 10)
- Re: http_inspect Jason Wallace (Nov 10)
- Re: http_inspect Jefferson, Shawn (Nov 10)
- Re: http_inspect Jason Wallace (Nov 10)