[Snort-users] Alerts of "(http\_inspect) NON-RFC DEFINED CHAR"

M. Salman Farisi msalmanf at ...11176...
Fri Feb 27 05:15:03 EST 2004


copy unicode.map from installation source to your /etc/snort directory
hope this help


On Fri, 27 Feb 2004, Gabriel Assis Amancio wrote:

> 	Hi!
>
> 	I have just installed Snort 2.1 on RedHat 7.3 ...
> 	I was receiving a lot of alerts like this:
> 		(http\_inspect) NON-RFC DEFINED CHAR
> 		(http\_inspect) NON-RFC HTTP DELIMITER
> 		(http\_inspect) APACHE WHITESPACE (TAB)
> 		(http\_inspect) NON-RFCF DEFINED CHAR
> 		(http\_inspect) OVERSIZE CHUNK ENCODING
>
> 	when my configuration was there:
>
> 		preprocessor http_inspect: global \
> 		    iis_unicode_map unicode.map 1252
>
> 		preprocessor http_inspect_server: server default \
> 		    profile all \
> 		    ports { 80 8080 }
>
>
> 	After this, I change my configuration for this:
>
>
> 		preprocessor http_inspect: global \
> 		    iis_unicode_map unicode.map 1252
>
> 		preprocessor http_inspect_server: server default \
>





More information about the Snort-users mailing list