[Snort-users] Question about http_insepct
Thomas at ...9508...
Thu Apr 1 08:21:02 EST 2004
I don't understand one http_inspect parameter. The parameters is:
if i set this parameter to yes the doc say that alerts will be generated. but
why? whats a iss_delimiter? I don't understand the doc from http_inspect at
Documentation about that parameter say:
The 'yes/no' argument does not specify whether the configuration option
itself is on or off, only the alerting functionality.
* iis_delimiter [yes/no] *
I originally started out with \n being IIS specific, but Apache takes this
non-standard delimiter was well. Since this is common, we always take this
as standard since the most popular web servers accept it. But you can still
get an alert on this option.
My Question is on which conditions i'll get an alert?
More information about the Snort-users