Snort mailing list archives
Re: IPHONE user agent?
From: Joel Esler <jesler () sourcefire com>
Date: Sun, 2 Dec 2012 11:37:15 -0500
It shouldn't be. The User-Agent should be all in caps. Which isn't an iPhone. -- Joel Esler Sent from my iPad On Dec 1, 2012, at 11:10 PM, Jeff Kell <jeff-kell () utc edu> wrote:
This "BLACKLIST User-Agent known malicious user-agent string IPHONE" sig is going off all over the place. Appears to be real iPhones (?) Clarification? Looks like a pre-baked detection criteria... Jeff ------------------------------------------------------------------------------ Keep yourself connected to Go Parallel: DESIGN Expert tips on starting your parallel project right. http://goparallel.sourceforge.net/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Keep yourself connected to Go Parallel: DESIGN Expert tips on starting your parallel project right. http://goparallel.sourceforge.net/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- IPHONE user agent? Jeff Kell (Dec 01)
- Re: IPHONE user agent? Jeff Kell (Dec 01)
- Re: IPHONE user agent? Joel Esler (Dec 02)
- Re: IPHONE user agent? Joel Esler (Dec 03)