Re: what would be the effect?

[Andreu.Gomez () keisa intrakom com]

Hi Onie,
 I think the main purpose of those preprocessors is detect code red or
nimda attacks. In my case I don't have any IIS so I disabled the rule
because It was giving me a lot of false alarms ( i mean a lot, more than 50
every day). Mainly the cause of this could be the japanese unicode used by
some users in my company, but this is something I haven't tested.

andreu


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users