False Positive ?

Hi Roman,

Please post a copy of your IPS settings.

Ian

https://www.snort.org/rule-docs/1-32998

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2850

As it only affected the Sophos Web Appliance Interface (SWA), i would guess false positive. 

This policy is used ;) Im also thinking thats a F/P. But i just wanna to be somehow sure. Weird is that it points to a Facebook ip addr with "Sophos Web Appliance" - how is this combined :)

IPS will inspect for all loaded Snort rules. 

If some traffic matches, it will alert and block this traffic. 

https://en.wikipedia.org/wiki/Intrusion_detection_system#Signature-based

Maybe somebody within Facebook developed a application, which uses similar traffic. 

A big Thanks for your explanation and help ;) cheers!

A big Thanks for your explanation and help ;) cheers!