[Snort-sigs] Documentation for Rule 488 INFO Connection Closed MSG from Port 80

Brian bmc at ...95...
Sat Dec 13 20:03:00 EST 2003


On Sat, Dec 13, 2003 at 11:06:23AM -0800, Joe Hdez wrote:
> After establishing a successful connection via telnet to an open port
> 80 on a remote host, diferent kinds of methods like GET could be used
> to display valuable information from the remote webserver. Examples of
> this information are the webserver version and complementary web
> services version like PHP, etc. Once the information has been
> displayed, the remote host closes the connection with a "Connection
> closed by foreign host" message.

Sorry, but this is wrong.  I don't have time to explain it now, but
trust me.  Normal web servers (even when you use telnet to connect to
them) NEVER end the connection with "Connection closed by foreign host".

Brian




More information about the Snort-sigs mailing list