[Snort-users] http_decode_preprocessor

Erich Meier Erich.Meier at ...99...
Mon Jan 8 08:22:18 EST 2001


On Mon, Jan 08, 2001 at 01:05:34PM +0100, Andrea Barisani wrote:
> Hi to all!
> 
> I'm using snort 1.7 and I'm getting a LOT of false alert from the http
> decode preprocessor (IIS Unicode Attack), so I have disable in the
> preprocessor source code the alerting and loggin functions.
> 
> Is this a common problem?

Yes, this is a common problem here. Therefore you can use the new "-unicode"
argument for the preprocessor init command.

e.g.:

preprocessor http_decode: 80 443 8080 -unicode

Hope this helps,
Erich




More information about the Snort-users mailing list