[Snort-sigs] http-inspect sig id Snort Alert 21

Nigel Houghton nhoughton at ...435...
Fri Apr 16 08:38:36 EDT 2010


On Thu, Apr 15, 2010 at 11:10 PM, Russell Fulton
<r.fulton at ...575...> wrote:
> I am seeing several of these on various snort sensors
>
> Snort Alert [119:21:0]
>
> so far as I can see the latest gen-sig.map goes up to 119:18...
>
> Any idea what these are?
>
>
>
> Russell Fulton
>
> Information Security Officer, The University of Auckland
> New Zealand
>
>
>
>
> ------------------------------------------------------------------------------
> Download Intel® Parallel Studio Eval
> Try the new software tools for yourself. Speed compiling, find bugs
> proactively, and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs

Yes, it is "MULTIPLE CONTENT LENGTH HEADER FIELDS".

There's an updated gen-msg.map going out with Snort 2.8.6 next week.

-- 
Nigel Houghton
Head Mentalist
SF VRT
http://vrt-sourcefire.blogspot.com && http://labs.snort.org/




More information about the Snort-sigs mailing list