No subject

Thu Nov 23 16:36:19 EST 2017

* apache_whitespace [yes/no] *
This option deals with non-RFC standard of tab for a
space delimiter.  Apache
uses this, so if the emulated web server is Apache you
need to enable this
option.  Alerts on this option may be interesting, but
may also be false
positive prone.

 bare_byte [yes/no] *
Bare byte encoding is an IIS trick that uses non-ASCII
chars as valid values in
decoding UTF-8 values.  This is NOT in the HTTP
standard, as all non-ASCII
values have to be encoded with a %.  Bare byte
encoding allows the user to 
emulate an IIS server and interpret non-standard
encodings correctly.

--- Bill Parker <dogbert at ...11664...> wrote:
> Hi All,
>     I was wondering if someone could give me some
> insight into the following items:
> [**] [119:4:1] (http_inspect) BARE BYTE UNICODE
> 04/16-19:58:54.674946 ->
> [**] [119:3:1] (http_inspect) U ENCODING [**]
> 04/16-19:31:11.433642 ->
> Is it possible to enable the use of SYSLOG and at
> the same time, log information to the
> /var/log/snort/alert file as well?
> Bill

Do you Yahoo!?
Yahoo! Tax Center - File online by April 15th

More information about the Snort-users mailing list