AW: [Snort-devel] spp_unidecode false alert reduction

Chris Green cmg at ...402...
Tue May 28 08:12:05 EDT 2002

"Poppi, Sandro" <Sandro.Poppi at ...1204...> writes:

> Hi Chris,
> thanks for your answer.
> If I understood you right I have 2 choices:
> Either use snort 1.9.x and http_decode or stay at 1.8.x and live with those
> alerts of unidecode, since according to the comments in your shipped
> snort.conf unidecode's use is recommended instead of http_decode in 1.8.x.

Sorry, that's an artifact of an era gone by when HTTP decode didn't
understand unicode at all. I've removed it from the default snort.conf

Chris Green <cmg at ...402...>
This is my signature. There are many like it but this one is mine.

More information about the Snort-devel mailing list