Re: [Snort-sigs] FPs on community sids 100000118,100000119

On Jan 9, 2006, at 7:57 PM, Jeff Kell wrote:
> The original rules are designed to catch a buffer overflow with an 
> overly long 'Content-type:' or 'Content-encoding:' tag.  The current 
> signatures are looking for those content strings, followed by 200 
> bytes of  [^\r\n].  Several webmail clients are causing FPs on this 
> sig, the text they actually return is delimited by <br> notation, or 
> with AOL they are sometimes delimited by the literals "\r\n" (format 
> string?).  At any rate, the expected <cr>/<lf> terminators aren't 
> there, and the sigs fire.

Can you send an example packet that shows the FP?

Brian



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs