Re: sidestep

From: Brian <bmc(at)snort.org>
Date: Sun May 04 2003 - 13:08:10 EDT

On Tue, Apr 29, 2003 at 01:28:54PM +0100, Jill Tovey wrote:
> [**] RPC portmap listing [**]

You are looking at the decoded version of the packet. Right now, the rpc decoder inside of snort decodes on top of the original packet instead of writing the decoded version into a temporary buffer.

-brian

---

Can you respond to attacks based on attack type, severity, source IP, destination IP, number of times attacked, or the time of day an attack occurs? No?
No wonder why you're swamped with false positives! Download a free 15-day trial of Border Guard and watch your false positives disappear.

http://www.securityfocus.com/StillSecure-focus-ids2

---

Received on Tue May 6 16:44:25 2003