Help, tons of false positive ASN1 overflow attempts.

["Aharon" <aharon () superfreeway com>]

Pardon my vague message here.  I am a snort newbie!

I just installed Snort v2.2.0 and the latest signatures inside our network
here at work.  Anyway,  everything seems to work great,  except for a vast
amount of false positive ASN1 warnings.

I do not want to disable these ASN1 signatures becuase they would be very
usefull in finding virus infected PC's throughout our network.  Most ASN1
errors seem to be communications between XP clients and windows 2000 and
2003 servers.

For example:
0.01    1       172.16.221.166  10.33.1.108 NETBIOS SMB DCERPC NTLMSSP asn1
overflow attempt {tcp}

.166 is a clean virus free XP client,  and .108 is a Windows 2003 server. 
I am getting literally hundreds of these a second.

How can I help in figuring out what this issue is?  I can provide any info
you need,  just tell me what you need me to do.

Aharon


-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users