[Snort-sigs] GID3 SID16408 False Positives

evilghost at ...3397... evilghost at ...3397...
Wed Feb 10 08:39:33 EST 2010

Thank you for looking into this and addressing it.


Monica Sojeong Hong wrote:
> The false positives you are seeing are the result of TCP window
> scaling (see RFC 1323). Thanks for the report, we will make the
> appropriate changes to the rule and we'll put out a revised version in
> the next release.
> Regards,

More information about the Snort-sigs mailing list