[Snort-users] UTF-8 and Unicode packet content under snort 1.8.7

Chris Green cmg at ...1935...
Sat Aug 17 16:41:02 EDT 2002

John Sage <jsage at ...2022...> writes:

> Hello world..
> I'm currently involved in a discussion on another list where the
> poster is stating that a Linux-based snort host, not updated to
> properly handle UTF-8/Unicode encodings, will not correctly represent
> binary-logged packet content that contains UTF-8/Unicode characters.

I think the issue you are running into is that older versions of snort
munged packet data when it normalized it wheras 1.9.x decode in a
separte normalization buffer.

The only thing that might be an issue is the use of isspace type macros.
Chris Green <cmg at ...1935...>
Laugh and the world laughs with you, snore and you sleep alone.

More information about the Snort-users mailing list