Snort mailing list archives
Re: [Snort-devel] A weird packet..... perhaps a bug?
From: Chris Green <cmg () sourcefire com>
Date: Mon, 03 Feb 2003 08:58:19 -0500
Frank Knobbe <fknobbe () knobbeits com> writes:
I recently caught the packet below with Snort 1.9 compiled Jan 29 from CVS. It lists some weird content. The upper half looks like a valid HTTP requests (I verified that that image exists and is indeed called from the referring page). The bottom half looks like a snippet from an email, which would explain why this packet triggered on port 25.
That was a bug with unitialized uri counts in 1.9 -- Chris Green <cmg () sourcefire com> "Yeah, but you're taking the universe out of context." ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- A weird packet..... perhaps a bug? Frank Knobbe (Feb 02)
- Re: A weird packet..... perhaps a bug? Erek Adams (Feb 03)
- Re: [Snort-devel] A weird packet..... perhaps a bug? Chris Green (Feb 03)
- Re: A weird packet..... perhaps a bug? Kenneth G. Arnold (Feb 03)
- <Possible follow-ups>
- RE: A weird packet..... perhaps a bug? Cornelis, Dirk (BE - Diegem) (Feb 03)