[Snort-sigs] Holy false Positives

VanBrecht, Jason Jason.VanBrecht at ...2498...
Wed Jun 16 08:07:00 EDT 2004


Windows domain controllers will also trigger this.


-----Original Message-----
From: snort-sigs-admin at lists.sourceforge.net
[mailto:snort-sigs-admin at lists.sourceforge.net] On Behalf Of Joe
Matusiewicz
Sent: Wednesday, June 16, 2004 10:34 AM
To: Goodson, Jacob; 'snort-sigs at lists.sourceforge.net'
Subject: Re: [Snort-sigs] Holy false Positives


At 10:01 AM 6/16/2004, Goodson, Jacob wrote:

What could be causing the L3retriever Ping signature to trigger?  I
think it is a false positive.

Some windows third party software that checks to see if a host is up.  I
turn this rule off to turn down the noise that I don't want to see.


-- Joe 




More information about the Snort-sigs mailing list