Re: false positives?

[Brian <bmc () snort org>]

On Mon, Nov 29, 2004 at 09:14:32AM -0500, Jeff Schmidt (CACL Tech Asst) wrote:
>  I'm receiving a high number of the following alert:
> "NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt"

Yep, this is known.  I've got an update for this rule that I'm
currently testing.  Look for an update soon.

> Also, I'm getting another alert that appears that it might be related: 
> "NETBIOS SMB-DS IPC$ share unicode access."  Again, is this just snort 
> detecting completely normal traffic?

Yes.  Do NOT disable this rule, unless you plan on disabling nearly
all of the other netbios rules at the same time.  If you don't want to
see alerts from this rule, add a suppression, or add a
"flowbits:noalert;" to the end of the rule.

Brian


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users