[Snort-users] IIS Unicode attack

Erich Meier Erich.Meier at ...99...
Fri Jan 26 03:41:38 EST 2001


On Thu, Jan 25, 2001 at 01:34:46PM -0500, Keith McDuffee wrote:
> With Snort 1.7 running on OpenBSD 2.6, I'm getting an awful lot of "IIS
> Unicode attack detected" triggers in my log files when people are visiting
> legit sites.  What's the easiest way just to turn this off besides (I
> assume) turning off http decoding?

Specify a "-unicode" argument at the http_decode preprocessor statement.

Erich




More information about the Snort-users mailing list