Re: [Snort-users] Bare byte alerts but no non-ASCII characters!

Julio,

Can you post a pcap of the offending traffic (if it contains sensitive
info, post to bugs@snort.org) so we can attempt to debug the issue.

Thanks,
Todd

Julio Cesar Gazquez wrote:
> I'm looking at several "BARE BYTE UNICODE ENCODING" alerts, and wondering why
> are triggered, because as far as I understand it, it means there are
> non-ASCII, non percent encoded characters in the request.
>
> However, all the bytes in the payload (at least as shown in BASE, and I don't
> have favorite suspects), are in the sub 0x80 range.
>
> Any ideas about why this is happening? They aren't the only weird alerts I've
> got, but one of the most prevalent.
>


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users