[Snort-sigs] SID:13310

Wallace, Jason jason.wallace at ...3359...
Wed Nov 12 11:59:36 EST 2008

I seem to get a lot of false positives related to responses from IIS servers with SID:13310.

Since this is specific to Apache, is there any reason it should not be updated with a simple...

content:"Apache"; nocase;

This would probably also cut down on the number of times this giant pcre would need to be evaluated.


Jason R. Wallace
Talecris Biotherapeutics
Information Solutions
Sr. IS Security Analyst

More information about the Snort-sigs mailing list