[Snort-sigs] Documentation for Rule 488 INFO Connection Closed MSG from Port 80
r.fulton at ...575...
Sun Dec 14 11:20:00 EST 2003
On Sun, 2003-12-14 at 17:01, Brian wrote:
> Sorry, but this is wrong. I don't have time to explain it now, but
> trust me. Normal web servers (even when you use telnet to connect to
> them) NEVER end the connection with "Connection closed by foreign host".
Hmm... I agree and this raises the question: isn't the rule
fundamentally broken since that text will never traverse the network?
So unless I have missed something this rule should be dropped.
Russell Fulton /~\ The ASCII
Network Security Officer \ / Ribbon Campaign
The University of Auckland X Against HTML
New Zealand / \ Email!
More information about the Snort-sigs