[Snort-users] IIS Unicode attack

Neil Dickey neil at ...1633...
Tue May 1 10:33:19 EDT 2001

"moran" <Moran at ...1948...> wrote asking:

>Is there a way I can tell snort Ignore the Unicode attack checking to this
>specific host?

Not as far as I know.  You can only turn off the unicode alerts generally
by using the "-unicode" option for the appropriate preprocessor:

  preprocessor http_decode: 80 8080 -unicode

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois

More information about the Snort-users mailing list