[Snort-sigs] Documentation for Rule 488 INFO Connection Closed MSG from Port 80

Russell Fulton r.fulton at ...575...
Sun Dec 14 11:20:00 EST 2003

On Sun, 2003-12-14 at 17:01, Brian wrote:

> Sorry, but this is wrong.  I don't have time to explain it now, but
> trust me.  Normal web servers (even when you use telnet to connect to
> them) NEVER end the connection with "Connection closed by foreign host".

Hmm... I agree and this raises the question: isn't the rule
fundamentally broken since that text will never traverse the network?

So unless I have missed something this rule should be dropped.

Russell Fulton                                    /~\  The ASCII
Network Security Officer                          \ /  Ribbon Campaign
The University of Auckland                         X   Against HTML
New Zealand                                       / \  Email!

More information about the Snort-sigs mailing list