Snort mailing list archives
FP on 18372
From: "Weir, Jason" <jason.weir () nhrs org>
Date: Wed, 16 Feb 2011 09:43:38 -0500
Looks like a client downloading flash content... GET /portal/server.pt/gateway/PTARGS_0_2_23634_14364_435710_43/http%3B/pubco ntent.state.pa.us/publishedcontent/publish/cop_general_government_operat ions/sers/branding/flash/animation_homepage2.swf HTTP/1.1 Accept: */* User-Agent: contype Host: www.sers.state.pa.us Cookie: *****removed****** GET /swf/masthead_large.swf HTTP/1.1 Accept: */* User-Agent: contype Host: www.wxrv.com Cookie: *****removed****** GET /multimedia/archive/00379/sivananda_sports_379768a.swf HTTP/1.1 Accept: */* User-Agent: contype Host: www.thehindu.com Can we improve on this rule? -J _____________________________________________________________________________________________ Please visit www.nhrs.org to subscribe to NHRS email announcements and updates. ------------------------------------------------------------------------------ The ultimate all-in-one performance toolkit: Intel(R) Parallel Studio XE: Pinpoint memory and threading errors before they happen. Find and fix more than 250 security defects in the development cycle. Locate bottlenecks in serial and parallel code that limit performance. http://p.sf.net/sfu/intel-dev2devfeb _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org
Current thread:
- FP on 18372 Weir, Jason (Feb 16)
- Re: FP on 18372 Joel Esler (Feb 16)
- Re: FP on 18372 Alex Kirk (Feb 16)
- Re: FP on 18372 Joel Esler (Feb 16)
- Re: FP on 18372 waldo kitty (Feb 16)
- Re: FP on 18372 Alex Kirk (Feb 16)
- Re: FP on 18372 Weir, Jason (Feb 16)
- Re: FP on 18372 Joel Esler (Feb 16)