[Snort-users] Snort Alert[1:16482:8]

Castle, Shane scastle at ...14946...
Tue Mar 26 12:32:01 EDT 2013

The info I have suggests that this rule has a very low or zero FP rate, indicating that you are mistaken and that there are really some IE 6 and 7 browsers on your net. I'd suggest following up on the IP addresses to see what is going on.

Of course, it's possible that the alerts are being generated from browsers outside your network if you do not have $EXTERNAL_NET and $HOME_NET set up properly.

Shane Castle
Data Security Mgr, Boulder County IT

-----Original Message-----
From: Kee, Scott [mailto:Scott.Kee at ...16186...] 
Sent: Tuesday, March 26, 2013 08:38
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Snort Alert[1:16482:8]

I recently installed Snort on my Ubuntu machine.    I am receiving a lot of 16482:8 alerts.  It is Microsoft ie 6 and 7 vulnerability alert.

I don't have any users who are on using IE 6 or 7.  What is triggering this alert?  Is this safe to ignore?





More information about the Snort-users mailing list