[Snort-users] -z est missing alerts?

Andreas Hasenack andreas at ...1574...
Tue Jan 8 04:08:13 EST 2002


snort-1.8.3

 From another machine, I start lynx and access http://target/../../
Snort catches this as a directory traversal rule.

I then restart snort with -z est and hit ctrl-r on lynx. Snort doesn't see
this anymore. I remove the -z est switch, hit ctrl-r and snort sees the
attack again.

Has anybody experienced something like this?
I'm about to do more thorough testing to make sure I'm not fooling myself.





More information about the Snort-users mailing list