[Snort-users] False Positives on POP3 USER & PASS overflow attempt?
James M. Driskell
jdriskell at ...8221...
Thu May 1 14:52:37 EDT 2003
We're seeing a ton of alerts for the POP3 USER & PASS overflow attempts.
Could these alerts be false positives? A quick review of some of these
alerts indicates that they are probably legitimate traffic. I'm running
snort v 1.9.0 with the latest rules.
Has anyone else seen this?
More information about the Snort-users