Re: False positives

[Gary Verhulp <garyv () cips nokia com>]

ahh.
you are right. www.screensavers.com was the trigger.
No reg ex.

So now what?

ext Chris Green wrote:
> Gary Verhulp <garyv () cips nokia com> writes:
>
>
> > That's what I'm sayin'
> > :)
> > I've determined that I have a false positive i.e. I've examined the
> > packets and I have  reliable instances of False positives.
> >
> > For instance <possible  .scr worm> is triggered by .scr
> > which, as I understand it, reads as any character followed by "scr"
>
>
> actually it's ".scr".  Those aren't regular expressions on your
> screen!  So its anytime the 4 byte pattern .scr is found 




-------------------------------------------------------
This sf.net emial is sponsored by: Influence the future 
of Java(TM) technology. Join the Java Community 
Process(SM) (JCP(SM)) program now. 
http://ad.doubleclick.net/clk;4699841;7576301;v?http://www.sun.com/javavote
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users