[Snort-users] False Positives on POP3 USER & PASS overflow attempt?

James M. Driskell jdriskell at ...8221...
Thu May 1 14:52:37 EDT 2003

Hello All,

We're seeing a ton of alerts for the POP3 USER & PASS overflow attempts.
Could these alerts be false positives?  A quick review of some of these
alerts indicates that they are probably legitimate traffic.  I'm running
snort v 1.9.0 with the latest rules.

Has anyone else seen this?  


Jim Driskell

More information about the Snort-users mailing list