Re: Bare byte alerts but no non-ASCII characters!

[Todd Wease <twease () sourcefire com>]

Julio,

Can you post a pcap of the offending traffic (if it contains sensitive
info, post to bugs () snort org) so we can attempt to debug the issue.

Thanks,
Todd

Julio Cesar Gazquez wrote:
> I'm looking at several "BARE BYTE UNICODE ENCODING" alerts, and wondering why 
> are triggered, because as far as I understand it, it means there are 
> non-ASCII, non percent encoded characters in the request.
>
> However, all the bytes in the payload (at least as shown in BASE, and I don't 
> have favorite suspects), are in the sub 0x80 range.
>
> Any ideas about why this is happening? They aren't the only weird alerts I've 
> got, but one of the most prevalent.


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users