[Snort-users] HTTP Referer causing alerts.

Jason Ish jason at ...490...
Wed Sep 20 18:24:34 EDT 2000


I have found that most of my CGI related alerts are due to the Referer:
part of the HTTP header.  Should I care what is in there?  In most cases
I don't think so.

I hacked up spp_http_decode.c quickly to remove the Referer to stop
these false alerts.  Is anyone interested in this?  Comments on whether
this is good or bad?

- Jason



More information about the Snort-users mailing list