Re: WEB-CLIENT Excel malformed FBI record - False positive?

[Jack Pepper <pepperjack () afferentsecurity com>]

> If this was how you imagined our setup then please try to explain the
> above in another way.

Starting over ....

I believe your IP address obfuscation is blurring the analysis.   
Please repost the rule definition and the original packet again.  This  
time change only the second octet of the IP addresses.  Defining both  
ends of the conversation as both being on the "10." network is messy.   
We'll just start over.

Also please include the following line from your snort.conf:  "var  
HOME_NET ... "


jp

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com


-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users