Windows2000 Load balancing requests detected as IIS Unicode attack

["Peter Zinck Wulff" <pzw () zw dk>]

Hi there.

I've just recently installed Snort to check it out, and what a great program
to detect "funny" network traffic, compared to some of the not OSS products,
like Blackice.

I have set it mointor the traffic to webservers, and it does a fine job with
that.

But, some of the normal trafic to a Windows 2000 load balancing IP-address
gets detected as IIS Unicode attacks, and I know for sure that is not the
case.

Anyone had that problem, and, how did you solve it?

Best Regards,
Peter



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users