[Snort-sigs] Holy false Positives

sekure sekure at ...2420...
Wed Jun 16 07:19:05 EDT 2004


I often see L3retriever Pings alerts as generic pings from a windows
box.  Not necessarily a false positive, but it's up to you to decide
whether or not it's important.  You might try suppression or
thresholding.

----- Original Message -----
Wrom: TFJMVRESKPNKMBIPBARHDMNNSKVFVWRKJVZC
Date: Wed, 16 Jun 2004 09:01:21 -0500
Subject: [Snort-sigs] Holy false Positives
To: "snort-sigs at lists.sourceforge.net" <snort-sigs at lists.sourceforge.net>









What could be 
causing the L3retriever Ping signature to trigger?  I think it is a false 
positive.




More information about the Snort-sigs mailing list