Re: snort rule 128-6 reporting but no description at VRT

[Ryan Jordan <ryan.jordan () sourcefire com>]

Sorry, failed to hit that shiny "Reply All" button earlier:

That's an SSH preprocessor alert. Specifically, rule 128:6 means
"Payload size incorrect for the given payload". It can happen if your
packets are truncated during the SSH key exchange.

More info is available in README.ssh in Snort's doc directory.

-Ryan

On Tue, Dec 14, 2010 at 10:57 AM, Lawrence R. Hughes, Sr.
<lhughes () safemedia com> wrote:
> Hi,
>
> Does anyone know why we are getting alerts for rule 128-6 and there is no
> description for this rule at VRT?
>
> Thanks,
> Larry
>
> ------------------------------------------------------------------------------
> Lotusphere 2011
> Register now for Lotusphere 2011 and learn how
> to connect the dots, take your collaborative environment
> to the next level, and enter the era of Social Business.
> http://p.sf.net/sfu/lotusphere-d2d
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Lotusphere 2011
Register now for Lotusphere 2011 and learn how
to connect the dots, take your collaborative environment
to the next level, and enter the era of Social Business.
http://p.sf.net/sfu/lotusphere-d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users