Re: False positives

[Chris Green <cmg () snort org>]

Gary Verhulp <garyv () cips nokia com> writes:

> That's what I'm sayin'
> :)
> I've determined that I have a false positive i.e. I've examined the
> packets and I have  reliable instances of False positives.
>
> For instance <possible  .scr worm> is triggered by .scr
> which, as I understand it, reads as any character followed by "scr"

actually it's ".scr".  Those aren't regular expressions on your
screen!  So its anytime the 4 byte pattern .scr is found 
-- 
Chris Green <cmg () sourcefire com>
A good pun is its own reword.


-------------------------------------------------------
This sf.net emial is sponsored by: Influence the future 
of Java(TM) technology. Join the Java Community 
Process(SM) (JCP(SM)) program now. 
http://ad.doubleclick.net/clk;4699841;7576301;v?http://www.sun.com/javavote
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users