[Snort-users] 1:17239 False Positive

Christopher A. Libby clibby at ...14973...
Tue Oct 12 08:32:49 EDT 2010

1:17239 "IMAP Alt-N MDaemon IMAP server CREATE command buffer overflow attempt" is giving me a false positive on SQL Server backup traffic.  Could this rule be successfully limited to known IMAP ports?

More information about the Snort-users mailing list