http_decode vs. alerts

["Williams Jon" <WilliamsJon () JohnDeere com>]

Now that things have started to quiet down a bit, I'm going through my logs
looking for why I wasn't seeing the kinds of alerts from Nimda that people
were reporting on the list.  What I found was that I'd set up custom actions
to handle all of my signatures, but most of the Nimda traffic was being
caught by the http_decode preprocessor and being recorded to a separate file
rather than following my custom actions.

I don't really care how I get there, but I'd like to get to the point where
all my alerts go to the same place.  Can I apply my custom actions to the
preprocessor?  Should I just remove the http_decode lines and just accept
the fact that I'll miss Unicode-obfuscated attacks?  Is there another option
that I've missed?

Thanks.

Jon


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users