[Snort-users] uricontent misbehaving?

Tim Kramer kramert at ...3975...
Fri Nov 2 11:51:04 EST 2001


Then again, just having the word the r-word with the
e-extension caused various people's mail servers to
spit the message back at me.  I guess the rule of
thumb should be to write the filter to be large
enough to be minimally functional without causing
false alerts.  There's a least 12 mail servers out
there using a commercial anti-virus program that
spit my last message back at me (and they should
know better).  Next thing you know, we'll not be
able to send e-mail because someone wrote a virus
that contains the word "the".

- Tim






More information about the Snort-users mailing list