[Snort-users] HTTP Referer causing alerts.
jason at ...490...
Wed Sep 20 23:15:14 EDT 2000
[Sorry if this is a repost, my original post didn't appear to make it.]
I have found that most of my CGI related alerts are due to the Referer:
part of the HTTP header. Should I care what is in there? In most cases
I don't think so.
I hacked up spp_http_decode.c quickly to remove the Referer to stop
these false alerts. Is anyone interested in this? Comments on whether
this is good or bad?
More information about the Snort-users