[Snort-users] MP3 Alerts

Frank Reid fcreid at ...691...
Thu Nov 23 08:58:33 EST 2000


Having a strange issue using the default misc-lib rules and current CVS of
Snort.  Apparently, Snort is alerting on "mp3" across all ports, rather than
just those defined in the rule set (8888, 7777, etc.)  This includes
in-transit SMTP or POP3 sessions just talking about MP3 files!  They can be
bad, but not THAT bad! :)  Any thoughts on why this is occurring?  Thanks.

Frank





More information about the Snort-users mailing list