Honeypots mailing list archives

What does mean "unknown signature" in Walleye?


From: Ivica Maric <imaravk () gmail com>
Date: Tue, 13 Jun 2006 02:29:17 +0200

Hi all!

Maybe this is not connected exactly with honeypots but i have one problem. Walleye showed me these alarms:
SHELLCODE x86 NOOP
WEB-FRONTPAGE /_vti_bin/ access
unknown signature
WEB-MISC Chunked-Encoding transfer attempt
WEB-FRONTPAGE rad fp30reg.dll access

OK i found description for all of them, exept unknown signature. When does unknown signature raising? What is purpose of unknown signature alarm? I did not found anything useful at www.snort.org.

Ivica Maric
www.fer.hr
Zagreb
Croatia


Current thread: