Snort mailing list archives

Apache Whitespace and Bare Byte Unicode Encoding


From: Lane LiaBraaten <lliabraa () isrparc org>
Date: Wed, 24 Mar 2004 08:59:24 -0500

I am running snort 2.1.0 outside my firewall.  I received about 7,000 Apache 
Whitespace alerts and 14,000 Bare Byte alerts last night.  The packets were 
destined for several different IPs all on port 80.  So it seems like one of 
the computers inside my network was sending out data, but I can't tell which 
one because my sensor is outside the firewall.  Does anyone recognize this 
behavior?  

TIA,
LGL


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: