No subject

Thu Nov 23 16:31:58 EST 2017

URI.  In this case, it finds the space and thinks it has found the end
of the URI, but this is incorrect.

Could this be fixed by changing the rule to use %20 or |20| instead of "
"?  I tried doing exactly that, but I still did not get the alert, but
this may be caused by the fact that I may not be using the correct http
decode options.


More information about the Snort-devel mailing list