[Snort-users] Question about http_insepct

Thomas Bechtold Thomas at ...9508...
Thu Apr 1 08:21:02 EST 2004


Hi,
I don't understand one http_inspect parameter.  The parameters is:

iis_delimiter <yes|no>
if i set this parameter to yes the doc say that alerts will be generated. but 
why? whats a iss_delimiter? I don't understand the doc from http_inspect at 
that point.


Documentation about that parameter say:
[snip]
IMPORTANT:
The 'yes/no' argument does not specify whether the configuration option
itself is on or off, only the alerting functionality.
[...]
 * iis_delimiter [yes/no] *
I originally started out with \n being IIS specific, but Apache takes this
non-standard delimiter was well.  Since this is common, we always take this
as standard since the most popular web servers accept it.  But you can still
get an alert on this option.
[snap]


My Question is on which conditions i'll get an alert?

Cheers Thomas





More information about the Snort-users mailing list