[Snort-users] Unicode false alert from Asian browsers?

M. Toren mtoren at ...125...
Tue Apr 24 15:21:29 EDT 2001

I am seeing thousands of spp_http_decode: IIS Unicode attack detected alerts 
coming from IP addresses in Asia (esp Korea).  Any chance the browser 
localization is causing this, or are they likely real scans?

Monte Toren

Get your FREE download of MSN Explorer at http://explorer.msn.com

More information about the Snort-users mailing list