Snort mailing list archives
Re: Using Snort & DB to remove false alarms
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Wed, 07 Apr 2004 13:15:38 +1200
On Wed, 2004-04-07 at 12:29, Brian wrote:
Uh, not really. Nessus attempts to retrieve a page that doesn't exist, forcing the issue on checking 404 banners. If you don't do that, how would you ever know that the "OK 200" that you get back is really an OK?
Oh yeah - pretty hard for Snort to do that... But it does demonstrate that just checking on the 404 would miss a lot... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Using Snort & DB to remove false alarms Sean Wheeler (Apr 06)
- Re: Using Snort & DB to remove false alarms Michael Boman (Apr 07)
- <Possible follow-ups>
- RE: Using Snort & DB to remove false alarms Kreimendahl, Chad J (Apr 06)
- RE: Using Snort & DB to remove false alarms Jason Haar (Apr 06)
- Re: Using Snort & DB to remove false alarms Brian (Apr 06)
- Re: Using Snort & DB to remove false alarms Jason Haar (Apr 06)
- RE: Using Snort & DB to remove false alarms Jason Haar (Apr 06)
- RE: Using Snort & DB to remove false alarms Kreimendahl, Chad J (Apr 07)
- RE: Using Snort & DB to remove false alarms Kreimendahl, Chad J (Apr 08)