[Snort-users] uricontent misbehaving?
kramert at ...3975...
Fri Nov 2 11:51:04 EST 2001
Then again, just having the word the r-word with the
e-extension caused various people's mail servers to
spit the message back at me. I guess the rule of
thumb should be to write the filter to be large
enough to be minimally functional without causing
false alerts. There's a least 12 mail servers out
there using a commercial anti-virus program that
spit my last message back at me (and they should
know better). Next thing you know, we'll not be
able to send e-mail because someone wrote a virus
that contains the word "the".
More information about the Snort-users