Snort mailing list archives
Re: can I remove asn1_decode preprocessor?
From: "Paul B. Poh" <paul () paulpoh com>
Date: Wed, 16 Apr 2003 09:17:45 -0400
You can remove that the asn1 preprocessor. That preprocessor is prone to lots of false positives.
I believe that Andrew Baker is working on a new SNMP decoder for Snort 2.x to replace the asn1 preprocessor.
-Paul Clayton Mascarenhas wrote:
HiI am getting a lot of spp_asn1 alerts. Will it hurt if I comment the asn1_decode preprocessor?? Is there any use of having this preprocessor? Thanks Clayton------------------------------------------------------------------------ Do you Yahoo!?The New Yahoo! Search <http://us.rd.yahoo.com/search/mailsig/*http://search.yahoo.com> - Faster. Easier. Bingo.
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- can I remove asn1_decode preprocessor? Clayton Mascarenhas (Apr 16)
- Re: can I remove asn1_decode preprocessor? Paul B. Poh (Apr 16)