[Snort-sigs] SID:13310

Wallace, Jason jason.wallace at ...3359...
Wed Nov 12 11:59:36 EST 2008


I seem to get a lot of false positives related to responses from IIS servers with SID:13310.

Since this is specific to Apache, is there any reason it should not be updated with a simple...

content:"Apache"; nocase;

This would probably also cut down on the number of times this giant pcre would need to be evaluated.


Thx,
Jason

@XXXXX{=================>
Jason R. Wallace
Talecris Biotherapeutics
Information Solutions
Sr. IS Security Analyst




More information about the Snort-sigs mailing list