[Snort-sigs] False Positives with SIDs 2505 and 2506?

Gary_Portnoy at ...2451... Gary_Portnoy at ...2451...
Tue May 4 05:43:08 EDT 2004


I just turned those two on last night, and saw a ton of false positives. 
We have a fair amount of SSL traffic to begin with, but so far all of the 
alerts i've seen are false positives.  I saw about 549 of 2506 and 6 of 
2505 before i suppressed them.  Something is not quite right.

> Yeah, I'm seeing false positives on both of those.  A lot more on 2506
> than 2505.  I have not been able to figure out what the cause is yet
> though - looks like normal ssl traffic at first glance.  But my
> network's pretty big and messy, so we see false positives on just about
> everything.
> 
> -Adam Hogan.
-------------------------------------------
Gary Portnoy






-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
This message is for the named person's use only. This communication is for 
informational purposes only and has been obtained from sources believed to 
be reliable, but it is not necessarily complete and its accuracy cannot be 
guaranteed. It is not intended as an offer or solicitation for the purchase
or sale of any financial instrument or as an official confirmation of any
transaction. Moreover, this material should not be construed to contain any
recommendation regarding, or opinion concerning, any security. It may
contain confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission. If
you receive this message in error, please immediately delete it and all
copies of it from your system, destroy any hard copies of it and notify the
sender. You must not, directly or indirectly, use, disclose, distribute, 
print, or copy any part of this message if you are not the intended 
recipient.  Any views expressed in this message are those of the individual
sender, except where the message states otherwise and the sender is 
authorized to state them to be the views of any such entity.

ITG Inc. reserves the right to monitor and archive all electronic 
communications through its network. 

ITG Inc. Member NASD, SIPC
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-





More information about the Snort-sigs mailing list