[Snort-users] mismatch.

Ryan Russell ryan at ...35...
Sat Jun 29 10:22:04 EDT 2002


On Sat, 29 Jun 2002, Ashley Thomas wrote:
> -- In the original packet it was 255c%255c% but when snort logs
>    it logs only 5c%5c%
>
>    Is this because of some decoding that happens like http or unicode ?

Yes, that's the HTTP decoder.

					Ryan





More information about the Snort-users mailing list