[Snort-sigs] False positive on rule SID 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt

Joseph Gama josephgama at ...144...
Wed Jul 14 13:12:40 EDT 2004


Hello,

Thank you for the excellent work done with Snort!

I am affraid that rule 2403 creates false positives.
If fires everytime I use Windows Explorer to browse
shared directories in our network. Attached is a
captured packet that fired the rule.

Best regards,

Joseph Gama


	
		
__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - 100MB free storage!
http://promotions.yahoo.com/new_mail 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt
Type: application/octet-stream
Size: 1500 bytes
Desc: NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20040714/b0685e52/attachment.obj>


More information about the Snort-sigs mailing list