<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body>
    <div class="moz-cite-prefix">Claus, <br>
      <br>
      Is your proxy injecting additional headers into the HTTP traffic?
      (usual suspect). Try bumping the "server_flow_depth" and
      "client_flow_depth" values in your Snort configuration.<br>
      <br>
      On 03/23/15 10:07, Claus Regelmann wrote:<br>
    </div>
    <blockquote cite="mid:B0439260506@...17125..." type="cite">
      <pre wrap="">Message was discarded by filter '\Custom\Strong\PHP' on line 2

Envelope (RCP file content):
Message-ID: <a class="moz-txt-link-abbreviated" href="mailto:B0439260505@...17123...">B0439260505@...17123...</a>
Return-path: <a class="moz-txt-link-abbreviated" href="mailto:snort-users-bounces@lists.sourceforge.net">snort-users-bounces@lists.sourceforge.net</a>
Received-From-MTA: lists.sourceforge.net (unverified [216.34.181.88])
Arrival-Date: 1426729877 (Wed, 18 Mar 2015 21:51:17 -0400)
Origin-IP: 216.34.181.88
X-Modus-WasEncrypted: YES
X-Modus-BlackList: <a class="moz-txt-link-abbreviated" href="mailto:216.34.181.88=OK;snort-users-bounces@lists.sourceforge.net=OK">216.34.181.88=OK;snort-users-bounces@lists.sourceforge.net=OK</a>
X-Modus-RBL: 216.34.181.88=OK
X-Modus-Trusted: 216.34.181.88=NO
X-Modus-Audit: TRUE;5;-28051960418533861;130716210777740000
X-CustID: 687
X-Modus-BuildNumber: 214.18364
DomainKey-Status: 0
Resolved-Return-path: <a class="moz-txt-link-abbreviated" href="mailto:snort-users-bounces@lists.sourceforge.net">snort-users-bounces@lists.sourceforge.net</a>
X-Modus-BATV: OFF
X-Modus-SRSRBL: OK
X-Sender-Origin: EXTERNAL

Recipient: <a class="moz-txt-link-abbreviated" href="mailto:brownr@...17124...">brownr@...17124...</a>
Original-Address: <a class="moz-txt-link-abbreviated" href="mailto:brownr@...17124...">brownr@...17124...</a>
Dsn-Original-Recipient: <a class="moz-txt-link-abbreviated" href="mailto:rfc822;brownr@...17124...">rfc822;brownr@...17124...</a>
Local-Status: Incoming

</pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the 
conversation now. <a class="moz-txt-link-freetext" href="http://goparallel.sourceforge.net/">http://goparallel.sourceforge.net/</a></pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a>

Please visit <a class="moz-txt-link-freetext" href="http://blog.snort.org">http://blog.snort.org</a> to stay current on all the latest Snort news!</pre>
    </blockquote>
  </body>
</html>