[Snort-users] can I remove asn1_decode preprocessor?

Paul B. Poh paul at ...6438...
Wed Apr 16 06:19:02 EDT 2003


You can remove that the asn1 preprocessor. That preprocessor is prone to 
lots of false positives.

I believe that Andrew Baker is working on a new SNMP decoder for Snort 
2.x to replace the asn1 preprocessor.

-Paul

Clayton Mascarenhas wrote:
> Hi
>  
> I am getting a lot of spp_asn1 alerts. Will it hurt if I comment the 
> asn1_decode preprocessor?? Is there any use of having this preprocessor?
>  
> Thanks
>  
> Clayton
> 
> 
> ------------------------------------------------------------------------
> Do you Yahoo!?
> The New Yahoo! Search 
> <http://us.rd.yahoo.com/search/mailsig/*http://search.yahoo.com> - 
> Faster. Easier. Bingo.





More information about the Snort-users mailing list