Re: can I remove asn1_decode preprocessor?

["Paul B. Poh" <paul () paulpoh com>]

You can remove that the asn1 preprocessor. That preprocessor is prone to 
lots of false positives.

I believe that Andrew Baker is working on a new SNMP decoder for Snort 
2.x to replace the asn1 preprocessor.

-Paul

Clayton Mascarenhas wrote:
> Hi
>  
> I am getting a lot of spp_asn1 alerts. Will it hurt if I comment the 
> asn1_decode preprocessor?? Is there any use of having this preprocessor?
>  
> Thanks
>  
> Clayton
>
>
> ------------------------------------------------------------------------
> Do you Yahoo!?
> The New Yahoo! Search 
> <http://us.rd.yahoo.com/search/mailsig/*http://search.yahoo.com> - 
> Faster. Easier. Bingo.



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users