[Snort-users] ACID: more alerts than I asked for in acid_stat_uaddr... :)

roman at ...438... roman at ...438...
Mon Jun 25 09:50:27 EDT 2001


If you are using lynx for a browser, mangled GET arguments are not surprising at all.

As noted in FAQ question #C-1, it has been my experience that long GET strings
appended to the URL will sometimes be malformed.  I will confess, that I don't know
 whether ACID is not encoding the data per spec and Mozilla/IE are just forgiving, 
or this is a genuine bug in lynx.

Roman

> This is interesting. The behaviour I described only happens when using
> links as the browser (and it still happens today, with the CVS version). 
> Using Mozilla, for example, or Netscape, it works as expected.
> 
> Em Wed, Jun 20, 2001 at 01:37:01PM +0000, roman at ...438... escreveu:
> > Bad GET arguments in a the hyperlink, I believe.  Patched and
> > commited.  Let me know if this was the only instance of
> > this issue.
> > 
> > Roman
> > 
> > > > ACID from CVS (updated a few minutes ago)
> > > > 
> > > > I'm in the "today's unique alerts" page. There I see an alert
> > > > which has:
> > > > Total: 1
> > > > # Sensors: 1
> > > > Src addr.: 1
> > > > Dst addr.: 1
> > > > First and last: the same date/time
> > > > 
> > > > When I click on, say, "src addr", I get two alerts (the same signature), 
> > > > one from today, and another from another day (the day before, in my case).
> > > > The same happens if I click on "Total", I get these two results instead of
> > > > the one that happened today. 
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> 



---------------------------------------------
This message was sent using Voicenet WebMail.
      http://www.voicenet.com/webmail/






More information about the Snort-users mailing list