[Snort-users] IIS Unicode attack

moran Moran at ...1948...
Tue May 1 05:42:30 EDT 2001


Hello,
I installed Snort here and it works fine I think.
But one of our web servers is working in Hebrew and this means the web site
is using
Unicode so when I look at the logs of snort I See thousands of lines like:

[**] spp_http_decode: IIS Unicode attack detected [**]

Is there a way I can tell snort Ignore the Unicode attack checking to this
specific host?

Thanks,
    Moran.





More information about the Snort-users mailing list