[Snort-sigs] spp_unidecode: Invalid Unicode String detected

John Berkers berjo at ...66...
Tue Sep 25 14:30:09 EDT 2001


Signatures that start with "spp_" are generated by a preprocessor.  If you
want to disable the unicode alerts do the following:

preprocessor http_decode: 80 8080 -nounicode

This is also commented on in the FAQ available at snort.sourcefire.com

Hope that answers your question.

John Berkers                                       ICQ: 112912
Network Services                            Hansen Corporation
john.berkers at ...78...               berjo at ...66...

-----Original Message-----
From: snort-sigs-admin at lists.sourceforge.net
[mailto:snort-sigs-admin at lists.sourceforge.net]On Behalf Of
Steve.Rudolph at ...129...
Sent: Wednesday, 26 September 2001 3:19
To: snort-sigs at lists.sourceforge.net
Subject: [Snort-sigs] spp_unidecode: Invalid Unicode String detected

Hopefully this is simple!
I have users that are bein hidden behind our fw and when they browse to
certian sites I get an alert for"spp_unidecode: Invalid Unicode String
I think I want to shut this off for that hide address, but how is the
question.  I would appreciate anyones assistance.

Steve Rudolph
This transmission is confidential and
intended solely for the person or
organization to whom it is addressed.
It may contain privileged and
confidential information.  If you are
not the intended recipient, you
should not copy, distribute or take
any action in reliance on it.

If you believe you received this
transmission in error, please
notify the sender.

Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net

More information about the Snort-sigs mailing list