Snort Forums Archive

Archive Home » Snort Advanced » http_inspect alerts

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

http_inspect alerts

Posted by jimmythegeek on March 10, 2005 13:23:00

I have a tremendous number of "http_inspect:non-rfc defined char" where non_rfc_char = { 0x00 }. Also many "http_inspect: double decoding attack" alerts.

Are these alert sources typically just disabled in the config for http_inspect?

Posted by roesch on March 13, 2005 17:29:06

They're straight up protocol anomalies, they may or may not be important to you based on the server being targeted and what you're running on it. You can probably ignore them safely.

-Marty

Posted by romulo_giordani on May 23, 2005 05:42:06

Change in to config file

preprocessor http_inspect_server: server default profile all ports { 80 8080 } no_alerts

add "no_alerts" in your "preprocessor http_inspect_server:"

By
Rômulo Giordani Boschetti