[Snort-users] Having http_inspect problems, can't turn options off

Kenneth Trimmmer kenneth.trimmer at ...12179...
Fri Aug 6 12:33:02 EDT 2004

I have recently experienced similar problems and this is what I have done to
fix it. I turned off alerting because of the over abundance of False
Positives. I believe that the false positives are in response to the SRC IP
Address has a high port number. I Believe that the http_inspect preprocessor
is monitor for HTTP traffic on ports other that 80 and that when it sends
off the alert. I do believe that the folks at sourcefire know this and are
working on a fix. So in the mean time here is my preprocessor line. 

preprocessor http_inspect_server: server default \
    profile all ports { 80  } oversize_dir_length 500 no_alerts

preprocessor http_inspect_server: server \
    profile apache ports { 80 } no_alerts

It looks like you need the no_alerts on the default preprocesser as well as
the additional preprocessors. 

This should not be to much of a risk because the http_inspect will continue
to do the normalization behind the scenes and alert on anything that matches
a rule. 

-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Chris Schock
Sent: Friday, August 06, 2004 12:34 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Having http_inspect problems, can't turn options off

I am using Snort 2.2 RC1

Here is my http_inspect config in snort.conf"

preprocessor http_inspect: global \
    iis_unicode_map unicode.map 1252 \

preprocessor http_inspect_server: server xxx.xxx.158.212 bare_byte no
preprocessor http_inspect_server: server xxx.xxx.158.213 no_alerts

preprocessor http_inspect_server: server default \
    profile all ports { 80 8080 } oversize_dir_length 500

My problem is that I am still getting lots and lots of "BARE BYTE UNICODE
ENCODING" alerts for both servers, despite trying to suppress that
specific alert for one, and turning alerting completely off for the other.
I tried turning it off globally as well, but whenever I try that snort
complains that there is a configuration problem.

What am I doing wrong?

This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list