[Snort-users] [http-inspect/SPNEGO]

Gregory D Hough mr6re9 at ...6025...
Thu Jun 16 09:39:13 EDT 2005


Snortsters,

I have been getting gobs of OVERSIZE REQUST-URI DIRECTORY alerts lately, 
since about June 03. HTTPD would answer these requests with a code 200 
and serve my index page. I didn't like that so I configured Apache to 
respond with a 400 by use of the directive LimitRequestFieldsize 2048. 
Since then these requests have been morphing whereby the continuation 
packet size has been growing and shrinking.

Am I just losing my marbles? What is this thing anyway? Do I have 
packets? Yes, lot's.

Thanks,
farmer6re9




More information about the Snort-users mailing list