[Snort-users] IIS Unicode attack detected

Habu Takuya habu at ...1066...
Wed Mar 14 05:42:20 EST 2001


Hello,
I think what generates this alert is not a rule, but
"HTTP decode Preprocessor".

If you use snort.conf file, probably you can see the following line
in the middle (around line 116):
preprocessor http_decode 80 8080

comment out this line.

> I'm new at snorg. I've installed the current release to control our
Internet
> traffic. I also installed the latest rulebase. Most of the alerts snort
> generates are "spp_http_decode: IIS Unicode attack detected" alerts. Those
> alerts occur often if some employes do a web connection to an internet
site.
> I want to turn off this alert but didn't find the rule which generates
this
> alert. Does anybody know where I can turn off this rule?
>






More information about the Snort-users mailing list