[Snort-users] HTTP Referer causing alerts.

Jason Ish jason at ...490...
Wed Sep 20 23:15:14 EDT 2000


[Sorry if this is a repost, my original post didn't appear to make it.]

I have found that most of my CGI related alerts are due to the Referer:
part of the HTTP header.  Should I care what is in there?  In most cases
I don't think so.

I hacked up spp_http_decode.c quickly to remove the Referer to stop
these false alerts.  Is anyone interested in this?  Comments on whether
this is good or bad?

- Jason



More information about the Snort-users mailing list