Snort mailing list archives
Re: Various Alerts and Logging
From: Antonio Eugenio Villar <eugeniovillar () yahoo com>
Date: Sat, 17 Apr 2004 07:26:25 -0700 (PDT)
From README_http.inspect
* apache_whitespace [yes/no] * This option deals with non-RFC standard of tab for a space delimiter. Apache uses this, so if the emulated web server is Apache you need to enable this option. Alerts on this option may be interesting, but may also be false positive prone. bare_byte [yes/no] * Bare byte encoding is an IIS trick that uses non-ASCII chars as valid values in decoding UTF-8 values. This is NOT in the HTTP standard, as all non-ASCII values have to be encoded with a %. Bare byte encoding allows the user to emulate an IIS server and interpret non-standard encodings correctly. --- Bill Parker <dogbert () netnevada net> wrote:
Hi All, I was wondering if someone could give me some insight into the following items: [**] [119:4:1] (http_inspect) BARE BYTE UNICODE ENCODING [**] 04/16-19:58:54.674946 12.218.63.129:1777 -> 172.21.2.86:80 [**] [119:3:1] (http_inspect) U ENCODING [**] 04/16-19:31:11.433642 67.121.88.83:4150 -> 172.21.2.82:80 Is it possible to enable the use of SYSLOG and at the same time, log information to the /var/log/snort/alert file as well? Bill
__________________________________ Do you Yahoo!? Yahoo! Tax Center - File online by April 15th http://taxes.yahoo.com/filing.html ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Various Alerts and Logging Bill Parker (Apr 16)
- Re: Various Alerts and Logging Antonio Eugenio Villar (Apr 17)