[Snort-sigs] Another false positive - sid:2435

Paul Schmehl pauls at ...1311...
Fri Mar 18 15:02:26 EST 2005


--On Friday, March 18, 2005 05:48:45 PM -0500 Scott Dexter 
<scott.dexter at ...2420...> wrote:
>
> With a space you always run the chance of a false negative too,

Can you give an example?

If you're looking for files named foo.eml, what could follow eml without 
"screwing up" the filename?

Paul Schmehl (pauls at ...1311...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-sigs mailing list