[Snort-users] IIS Unicode attack
Erich.Meier at ...99...
Fri Jan 26 03:41:38 EST 2001
On Thu, Jan 25, 2001 at 01:34:46PM -0500, Keith McDuffee wrote:
> With Snort 1.7 running on OpenBSD 2.6, I'm getting an awful lot of "IIS
> Unicode attack detected" triggers in my log files when people are visiting
> legit sites. What's the easiest way just to turn this off besides (I
> assume) turning off http decoding?
Specify a "-unicode" argument at the http_decode preprocessor statement.
More information about the Snort-users