[Snort-users] Possible Queso Fingerprint attempt?

Fyodor fygrave at ...121...
Fri Mar 16 06:36:05 EST 2001


On Thu, Mar 15, 2001 at 12:43:01PM +0100, Ookhoi wrote:
> Hi Aaron,
> 
> > Kind of a drag since they tend to send 50 to 100 messages to the list
> > members a day and logging that and checking up on it sucks.
> > 
> > Let me know if you find a solution and I will pass it on to the system I am
> > talking about.
> 
> I found out this is a bug in snort and a know one too. Dunno what a
> solution is, sorry. The reason a connect from a linux server triggers
> the Queso Fingerprint Attempt rule is that linux has a feature called
> ecn. Read more about it on http://www.sans.org/y2k/ecn.htm
> 

*ugh*, let's call it 'a feature' in snort too then. :)




More information about the Snort-users mailing list