[Snort-sigs] Lotsa 13974

Lay, James james.lay at ...3513...
Wed Oct 5 11:54:28 EDT 2011

From: Alex Kirk [mailto:akirk at ...435...] 
Sent: Wednesday, October 05, 2011 9:47 AM
To: Lay, James
Cc: snort-sigs at lists.sourceforge.net
Subject: Re: [Snort-sigs] Lotsa 13974

Whenever you've got something you're concerned is a false positive, we
need a PCAP to do any sort of diagnostics on the matter. I've seen you
specifically use the snort.org form, and that's been most helpful for us
dealing with issues like this. If you could send along PCAP data, via
whatever method you prefer, on these, that'd be great.

Hi Alex,

Last couple days I've tried to use the uploads link, but I get an error
and I'm not sure if it goes through or not.  I'll send along to the
research at ...435... instead.  Thanks Alex.


More information about the Snort-sigs mailing list