Snort.org home  
Got Source? About Snort About Sourcefire Snort FAQ
Sourcefire Network Security - the creators of Snort
Snort News Downloads Snort Docs Rules Snort Community Snort Forums Snort Training
Search Site
Search Rules
Account
email
password
not registered?
user preferences

Snort Forums Archive

Archive Home » Snort Newbies » bare_byte alert tuning

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

bare_byte alert tuning


Posted by peterp on March 16, 2005 06:30:16

I have my first Snort installation running and am now tuning out the false positives. I'm seeing a lot of alerts for BARE BYTE UNICODE ENCODING from my ISA Proxies. The documentation on bare_byte indicates that no legitimate clients encode UTF-8 this way but also says that IIS uses it so I'm wondering if it's a Microsoft thing and they have it enabled on ISA which would make these alerts false positives.

I'm leaning towards tuning these alerts out but am looking for a sanity check from the community.

Thanks,
site feedback | Terms of Use | Privacy Policy | forum archives ©2007 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved.