[Snort-sigs] Holy false Positives
Jason.VanBrecht at ...2498...
Wed Jun 16 08:07:00 EDT 2004
Windows domain controllers will also trigger this.
From: snort-sigs-admin at lists.sourceforge.net
[mailto:snort-sigs-admin at lists.sourceforge.net] On Behalf Of Joe
Sent: Wednesday, June 16, 2004 10:34 AM
To: Goodson, Jacob; 'snort-sigs at lists.sourceforge.net'
Subject: Re: [Snort-sigs] Holy false Positives
At 10:01 AM 6/16/2004, Goodson, Jacob wrote:
What could be causing the L3retriever Ping signature to trigger? I
think it is a false positive.
Some windows third party software that checks to see if a host is up. I
turn this rule off to turn down the noise that I don't want to see.
More information about the Snort-sigs