[Snort-users] Windows2000 Load balancing requests detected as IIS Unicode attack

Peter Zinck Wulff pzw at ...2341...
Wed Jun 20 03:37:15 EDT 2001

Hi there.

I've just recently installed Snort to check it out, and what a great program
to detect "funny" network traffic, compared to some of the not OSS products,
like Blackice.

I have set it mointor the traffic to webservers, and it does a fine job with

But, some of the normal trafic to a Windows 2000 load balancing IP-address
gets detected as IIS Unicode attacks, and I know for sure that is not the

Anyone had that problem, and, how did you solve it?

Best Regards,

More information about the Snort-users mailing list