[Snort-users] shellcode alerts on src port 80

Ted Stringer teds at ...5847...
Thu Sep 26 05:40:09 EDT 2002


I am running rh7.3 linux, snort 1.8.7, acid0.9.6, and I am getting a lot
of shellcode alerts.  All of them are from legit http traffic from http
servers.  I thought that the "!" was the not operator.  The shelcode
variable is set to "!80" just the way it comes in the default settings.

I hope someone can tell me what is wrong or at least point me in the
right direction.

Ted Stringer
Systems Administrator
Lancaster & Eure, P.A.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020926/1d1c0b20/attachment.html>


More information about the Snort-users mailing list