Snort mailing list archives

Extrange alerts


From: Ruben Rubio <webmaster () programasweb com>
Date: 07 Jan 2004 13:27:23 +0100


Hi,

I have been installer snort two days ago in a redhat 9. I have a lot of
alerts, but the problem is that my computer seems to be the source. I
would like to know 
if its normal (I m almost sure that its not) and what could i do to
solve the problem.

The alerts that i use to have are the following:

(http\_inspect) IIS UNICODE CODEPOINT ENCODING       2004-01-06
18:15:48         xx.xx.xx.xx:32837       66.102.9.99:80    
(http\_inspect) DOUBLE DECODING ATTACK                   2004-01-06
15:35:31         xx.xx.xx.xx:33780       64.4.26.250:80



Thanxs ...

Current thread: