[Snort-users] IDS254 False positive?

Bob Bernstein bob at ...1100...
Tue May 22 20:07:24 EDT 2001

On Tue, May 22, 2001 at 01:37:25PM -0500, Steve Halligan wrote:

> This is simply a webserver on port 80 replying to you.  You just happen to
> be using the same port the shaft client uses.  These rules stink, 'cause of
> just this reason.  They really need content filters.

Interestingly enough, a tad more digging at whitehats revealed this
announcement on the 'protocol details' page

'Content Data 
 Coming soon, this is under construction.'

Bob Bernstein
Esmond, R.I., USA

More information about the Snort-users mailing list