[Snort-users] IIS unicode.map

Jean-Sébastien Nicaise jsnicaise at ...11827...
Tue Jan 6 14:16:26 EST 2015


Hello,

Using the http_inspect preprocessor, I got all these false positives from
bad IIS unicode encoding (french canadian, eh!). When searching google, I
found out that most people simply turn off affected preprocessor signatures.

Looking around I found mentions to "ms_unicode_generator.c", within
README.http_inspect and in different snort cookbooks. That program could
build a correct unicode.map file for my IIS servers.

But it's nowhere to be found. And the last discussions I could find about
it date back from 2004 or so.


Has this simply been left behind?

Thanks!


Jean-Sébastien Nicaise
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150106/e75c8d9f/attachment.html>


More information about the Snort-users mailing list