Timeline for Snort "Protocol mismatch" from SSH preprocessor
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 25, 2016 at 2:26 | comment | added | JDS | Also, I apologize for a "ranty" post, but it has indeed been a frustrating past 2 weeks tuning Snort. | |
| Feb 25, 2016 at 2:26 | comment | added | JDS | Digging further I find that most of the enabled ssh preprocessor rules -- such as the "protocol mismatch" one -- are for old, old, ancient CVEs (i.e. ca 2000, 2001, 2002) that affect SSH v1 and/or Cisco routers that are I'm sure all patched by now, and if they aren't, I'm pretty sure you are well aware of this problem and have taken other steps to mitigate. At this point I have a big WTF about Snort -- why does the default config come so noisy, with processor rules that sniff for super old exploits? <cynicism>Is it really just to make money off configuration</cynicism>? | |
| Feb 25, 2016 at 2:22 | vote | accept | JDS | ||
| Feb 24, 2016 at 19:49 | answer | added | Herringbone Cat | timeline score: 4 | |
| Feb 24, 2016 at 19:22 | answer | added | Jakuje | timeline score: 1 | |
| Feb 24, 2016 at 18:58 | history | asked | JDS | CC BY-SA 3.0 |