[Snort-sigs] Re: Holy False Positives Batman

Brian bmc at ...95...
Wed Jun 16 13:55:02 EDT 2004


On Wed, Jun 16, 2004 at 04:37:44PM -0400, John J. Nagro wrote:
> Did you push the rule out yet?

Yep.  CVS is slow.

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Invalid HTTP Version String"; flow:to_server,established; content:"HTTP/"; isdataat:6,relative; content:!"|0A|"; within:5; reference:bugtraq,9809; reference:nessus,11593; classtype:non-standard-protocol; sid:2570; rev:6;)

Brian




More information about the Snort-sigs mailing list