[Snort-sigs] huge number of false positives for WEB-MISC SSLv3 invalid Client_Hello attempt?

Matthew Watchinski mwatchinski at ...435...
Mon Jul 26 12:50:18 EDT 2004

What sid and rev are you using?


Matt Ostiguy wrote:

>Am I the only one getting an unholy number of FPs on this rule? I
>believe there is some correlation with the keepalives/new mail polls
>that I.E 6 will send to an exchange 2000 outlook web access server, as
>I am seeing tons of FPs from *my* home network to my OWA 2k server
>every 2 minutes, along with tons of similar FPs from what are
>obviously OWA users
>This SF.Net email is sponsored by BEA Weblogic Workshop
>FREE Java Enterprise J2EE developer tools!
>Get your free copy of BEA WebLogic Workshop 8.1 today.
>Snort-sigs mailing list
>Snort-sigs at lists.sourceforge.net

More information about the Snort-sigs mailing list