Re: Various Alerts and Logging

[Antonio Eugenio Villar <eugeniovillar () yahoo com>]

> From README_http.inspect

* apache_whitespace [yes/no] *
This option deals with non-RFC standard of tab for a
space delimiter.  Apache
uses this, so if the emulated web server is Apache you
need to enable this
option.  Alerts on this option may be interesting, but
may also be false
positive prone.

 bare_byte [yes/no] *
Bare byte encoding is an IIS trick that uses non-ASCII
chars as valid values in
decoding UTF-8 values.  This is NOT in the HTTP
standard, as all non-ASCII
values have to be encoded with a %.  Bare byte
encoding allows the user to 
emulate an IIS server and interpret non-standard
encodings correctly.


--- Bill Parker <dogbert () netnevada net> wrote:
> Hi All,
>
>     I was wondering if someone could give me some
> insight into the following items:
>
> [**] [119:4:1] (http_inspect) BARE BYTE UNICODE
> ENCODING [**]
> 04/16-19:58:54.674946 12.218.63.129:1777 ->
> 172.21.2.86:80
>
> [**] [119:3:1] (http_inspect) U ENCODING [**]
> 04/16-19:31:11.433642 67.121.88.83:4150 ->
> 172.21.2.82:80
>
> Is it possible to enable the use of SYSLOG and at
> the same time, log information to the
> /var/log/snort/alert file as well?
>
> Bill


        
                
__________________________________
Do you Yahoo!?
Yahoo! Tax Center - File online by April 15th
http://taxes.yahoo.com/filing.html


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users