Welcome to the Sophos User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

LinkBack Thread Tools Display Modes
Prev Previous Post   Next Post Next
Junior Member
Join Date: Mar 2008
Location: Texas
Posts: 7
#1 (permalink)  
Old 09-09-2008, 05:49 PM
Default WEB-MISC PCT Client_Hello

Every hour I get these alerts which I believe are false positives. They seem to coincide with a user's mobile phone connecting via owa. Anybody else seeing this?
Intrusion Protection Alert

An intrusion has been detected. The packet has been dropped automatically.
You can toggle this rule between "drop" and "alert only" in WebAdmin.

Details about the intrusion alert:

Message........: WEB-MISC PCT Client_Hello overflow attempt
Details........: http://www.snort.org/pub-bin/sigs.cgi?sid=2515
Time...........: 2008:09:09-11:34:43
Packet dropped.: yes
Priority.......: 1 (high)
Classification.: Attempted Administrator Privilege Gain IP protocol....: 6 (TCP)
Not causing an issue with the user getting email just a dozen irritating notices every hour. Is there any way to stop alerts for this particular alert without disabling the entire group/category? In version 6 you could configure individual alerts within a category, it seems as though that functionality has been removed in version 7.30.

Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

All times are GMT. The time now is 06:58 PM.

Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2015, Jelsoft Enterprises Ltd.

These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.