Re: [Snort-sigs] [Fwd: Snort Signature for WedDAV]

From: Frank Knobbe <fknobbe(at)knobbeits.com>
Date: Fri Mar 21 2003 - 11:53:51 EST

On Thu, 2003-03-20 at 18:13, Frank Knobbe wrote:
> ---------- Forwarded message ----------
> Date: Wed, 19 Mar 2003 21:57:58 -0700 (MST)

urf.... too many false positives. I think Brian already discussed this rule, but from what it looks, it just doesn't fly due to buffer limitations.

Besides, I'm getting too many false positives, probably because it can not verify the non-existence of |0a| within that large of a search space.

Regards,
Frank

---

This SF.net email is sponsored by:Crypto Challenge is now open! Get cracking and register here for some mind boggling fun and the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigsReceived on Fri Mar 21 12:35:53 2003