Tomcat Denial of Service Attack

[darin.marais]

The signature id 5648 (Tomcat Denial of Service Attack) seams to be prone to false positives....

We have seen in a number of incidents, that when the destination of this attack uses the ephemeral port of 8007 with an established connection on TCP port 80, the signature is often triggered. The signature looks for the content \xfe\x0f

Is anyone else seeing this problem?

[jlimbo]

Can you please send me some more information and we can look into refining this signature.

An IPLog dmp file or a traffic capture would help me dig into the cause of the false positive.

-jonathan

[darin.marais]

i replied to you with the information you requested offline