Rule SID 1325

[Matt Linton <mlinton () email arc nasa gov>]

I've seen a few random messages to this effect in the past, but it's worth
noting: The rule #1325 seems to repeatedly false positive on SSH v2
connections as a part of the normal handshake. Is this rule obsolete, or
perhaps SSH with the minimum of options set simply has a lot of "00"
options at the end, matching the rule?


+---------------------------------------------------
| Regards;
| Matt Linton
| UNIX Systems Administrator
| ASANI Solutions, LLC.
+---------------------------------------------------


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?   SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users