No subject


Thu Nov 23 16:36:19 EST 2017


* apache_whitespace [yes/no] *
This option deals with non-RFC standard of tab for a
space delimiter.  Apache
uses this, so if the emulated web server is Apache you
need to enable this
option.  Alerts on this option may be interesting, but
may also be false
positive prone.

 bare_byte [yes/no] *
Bare byte encoding is an IIS trick that uses non-ASCII
chars as valid values in
decoding UTF-8 values.  This is NOT in the HTTP
standard, as all non-ASCII
values have to be encoded with a %.  Bare byte
encoding allows the user to 
emulate an IIS server and interpret non-standard
encodings correctly.


--- Bill Parker <dogbert at ...11664...> wrote:
> Hi All,
> 
>     I was wondering if someone could give me some
> insight into the following items:
> 
> [**] [119:4:1] (http_inspect) BARE BYTE UNICODE
> ENCODING [**]
> 04/16-19:58:54.674946 12.218.63.129:1777 ->
> 172.21.2.86:80
> 
> [**] [119:3:1] (http_inspect) U ENCODING [**]
> 04/16-19:31:11.433642 67.121.88.83:4150 ->
> 172.21.2.82:80
> 
> Is it possible to enable the use of SYSLOG and at
> the same time, log information to the
> /var/log/snort/alert file as well?
> 
> Bill


	
		
__________________________________
Do you Yahoo!?
Yahoo! Tax Center - File online by April 15th
http://taxes.yahoo.com/filing.html




More information about the Snort-users mailing list