[Snort-sigs] False positive on rule SID 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt

Nigel Houghton nigel at ...435...
Wed Jul 14 13:44:11 EDT 2004


Make sure your $HOME_NET and $EXTERNAL_NET variables are set correctly.

On  0, Joseph Gama <josephgama at ...144...> allegedly wrote:
> Hello,
> 
> Thank you for the excellent work done with Snort!
> 
> I am affraid that rule 2403 creates false positives.
> If fires everytime I use Windows Explorer to browse
> shared directories in our network. Attached is a
> captured packet that fired the rule.
> 
> Best regards,
> 
> Joseph Gama
> 
> 
> 	
> 		
> __________________________________
> Do you Yahoo!?
> New and Improved Yahoo! Mail - 100MB free storage!
> http://promotions.yahoo.com/new_mail 

-------------------------------------------------------------
Nigel Houghton       Research Engineer        Sourcefire Inc.
                 Vulnerability Research Team

"Dude, dolphins are intelligent and friendly!" -- Wendy
"Intelligent and friendly on rye bread, with some mayonaise." -- Cartman




More information about the Snort-sigs mailing list