Re: WEB-MISC SSLv3 invalid Client_Hello attempt

Brian, I might be able to give you some pcaps for this. I get them now and 
then. I usually get the invalid http version alert because of the version 
part of the HTTP header from our work proxy is obfustcated.

:-)

Shirkdog

> From: Brian <bmc@xxxxxxxxx>
> To: Vladimir Stavrinov <vs@xxxxxxxx>
> CC: snort-sigs@xxxxxxxxxxxxxxxxxxxxx
> Subject: Re: [Snort-sigs] WEB-MISC SSLv3 invalid Client_Hello attempt
> Date: Thu, 14 Oct 2004 10:29:14 -0400

> Can you send pcap of one of the alerts going off?  There are still a
> few quirks of SSL that I havn't nailed down in the rules yet.
>
> thanks,
> Brian

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl