|
WEB-MISC SSLv3 invalid Client_Hello attempt: msg#00084security.ids.snort.sigs
Hi! The site content, I am maintaining, is accessible through the ssl only. But snort identify about 20% requests as "WEB-MISC SSLv3 invalid Client_Hello attempt" (GEN:SID 1:2522). These false alerts are produced by 70% different world wide clients (different IP). This type of alerts are 95% of total alerts, produced by snort on this system. I don't know what cause this. I think there are something wrong with this signature. -- ***************************** **** Vladimir Stavrinov *** ******* vs@xxxxxxxx ******* ***************************** ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl |
|
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| Previous by Date: | False Positive: 00084, Koelewijn, Bert |
|---|---|
| Next by Date: | false positive on 1:469 ICMP PING NMAP: 00084, Chris Connell |
| Previous by Thread: | False Positivei: 00084, Koelewijn, Bert |
| Next by Thread: | Re: WEB-MISC SSLv3 invalid Client_Hello attempt: 00084, Brian |
| Indexes: | [Date] [Thread] [Top] [All Lists] |
| News | FAQ | advertise |