[Snort-users] False positives on mysql traffic

For Sinton forsin at ...17149...
Mon Apr 27 23:54:06 EDT 2015

here is pcap traffic:
0000000: 41 00 00 00 03 53 45 4c 45 43 54 20 74   5f 5f 30 2e 2a 0a 46 52 4f 4d 20 0a 76  A....SELECT.t__0.*.FROM..v
000001A: 69 65 77 73 5f 76 69 65 77 20 74 5f 5f   30 0a 57 48 45 52 45 20 20 28 6e 61 6d  iews_view.t__0.WHERE..(nam
0000034: 65 20 49 4e 20 20 28 27 70 6f 6c 6c 73   27 29 29 20                             e.IN..('polls')).

----- Исходное сообщение -----
От: snort-users-request at lists.sourceforge.net
Кому: "forsin" <forsin at ...17149...>
Отправленные: Вторник, 28 Апрель 2015 г 9:52:50
Тема: Welcome to the "Snort-users" mailing list

Welcome to the Snort-users at lists.sourceforge.net mailing list! This
list is for general discussion of Snort usage, problems, design, etc.

Do not use this list, or the members of this list to market your or
any other products to.  We value our Community's privacy and their
right not to receive unsolicited email.  Any attempts to do so will
result in your being banned from the lists indefinitely.

To post to this list, send your email to:

  snort-users at lists.sourceforge.net

General information about the mailing list is at:


If you ever want to unsubscribe or change your options (eg, switch to
or from digest mode, change your password, etc.), visit your
subscription page at:


You can also make such adjustments via email by sending a message to:

  Snort-users-request at lists.sourceforge.net

with the word `help' in the subject or body (don't include the
quotes), and you will get back a message with instructions.

You must know your password to change your options (including changing
the password, itself) or to unsubscribe.  It is:


Normally, Mailman will remind you of your lists.sourceforge.net
mailing list passwords once every month, although you can disable this
if you prefer.  This reminder will also include instructions on how to
unsubscribe or change your account options.  There is also a button on
your options page that will email your current password to you.

More information about the Snort-users mailing list