Erich.Meier at ...99...
Mon Jan 8 08:22:18 EST 2001
On Mon, Jan 08, 2001 at 01:05:34PM +0100, Andrea Barisani wrote:
> Hi to all!
> I'm using snort 1.7 and I'm getting a LOT of false alert from the http
> decode preprocessor (IIS Unicode Attack), so I have disable in the
> preprocessor source code the alerting and loggin functions.
> Is this a common problem?
Yes, this is a common problem here. Therefore you can use the new "-unicode"
argument for the preprocessor init command.
preprocessor http_decode: 80 443 8080 -unicode
Hope this helps,
More information about the Snort-users