[Snort-sigs] GID3 SID16408 False Positives

evilghost at ...3397... evilghost at ...3397...
Wed Feb 10 08:39:33 EST 2010


Thank you for looking into this and addressing it.

-evilghost

Monica Sojeong Hong wrote:
> The false positives you are seeing are the result of TCP window
> scaling (see RFC 1323). Thanks for the report, we will make the
> appropriate changes to the rule and we'll put out a revised version in
> the next release.
>
> Regards,
>
>   




More information about the Snort-sigs mailing list