[Snort-users] Having http_inspect problems, can't turn options off

Chris Schock black at ...12235...
Fri Aug 6 09:20:05 EDT 2004


I am using Snort 2.2 RC1

Here is my http_inspect config in snort.conf"

================
preprocessor http_inspect: global \
    iis_unicode_map unicode.map 1252 \
    proxy_alert

preprocessor http_inspect_server: server xxx.xxx.158.212 bare_byte no
preprocessor http_inspect_server: server xxx.xxx.158.213 no_alerts

preprocessor http_inspect_server: server default \
    profile all ports { 80 8080 } oversize_dir_length 500
================

My problem is that I am still getting lots and lots of "BARE BYTE UNICODE
ENCODING" alerts for both servers, despite trying to suppress that
specific alert for one, and turning alerting completely off for the other.
I tried turning it off globally as well, but whenever I try that snort
complains that there is a configuration problem.

What am I doing wrong?






More information about the Snort-users mailing list