Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • +3 person also asked this people also asked this
  • Locked Locked
  • Replies 9 replies
  • Answers 1 answer
  • Subscribers 9 subscribers
  • Views 25475 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Lots of (http_inspect) UNKNOWN METHOD IPS alerts

Dale McKay

Since IPS pattern updates yesterday morning (Central US time) that installed the four pattern updates listed below, I have had almost non stop IPS alerts for the following IPS events. Prior to these updates I had not received one alert for these conditions. 

(http_inspect) UNKNOWN METHOD

(http_inspect) UNESCAPED SPACE IN HTTP URI

(http_inspect) LONG HEADER

Firmware version 9.502-4. Additional pattern updates since yesterday morning have failed to resolve this issue. I get hundreds of these IPS alerts... 

All this started with these four updates.

New Pattern Up2Dates have been installed. The current pattern version is now 9.24361

New Pattern Up2Dates have been installed. The current pattern version is now 9.7247.

New Pattern Up2Dates have been installed. The current pattern version is now 9.78.

New Pattern Up2Dates have been installed. The current pattern version is now 9.11258.



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    The issue is looked upon in NUTM-8469, we will update the fix asap.

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to sachingurung

    A month later now, and we're still getting flooded. Just received a firmware update notification, but to my surprise ticket NUTM-8469 is missing in the bugfixes of release notes. Can you please give us any information on the status of this issue? I hope you can imagine how annoying this problem is.

  • 0 in reply to Frans van der Wende

    Hi All,

    Sorry for a late reply. The issue is the result of some Snort rules that were previously disabled by default were inadvertently enabled in one of the rule updates. We are working on getting a new rule package which will be released via the normal up2date process. 

    Meanwhile, you can create an exception for the following list of Snort SIDs that were enabled in error.

    They include rules #:
    7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,27,28,29,30,31,32,34,35,36,37,38,39,40,41,42,43,48,49,50,51,52,53

    You can disable these rules manually from Network Protection > Intrusion Prevention > Advanced: Modified Rules - click the + : enter in rules sid# (found in the bulk of the alerts) and click "Disable this rule". You can add the others as you see fit but they do need to be added one by one. 

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Reply
  • 0 in reply to Frans van der Wende

    Hi All,

    Sorry for a late reply. The issue is the result of some Snort rules that were previously disabled by default were inadvertently enabled in one of the rule updates. We are working on getting a new rule package which will be released via the normal up2date process. 

    Meanwhile, you can create an exception for the following list of Snort SIDs that were enabled in error.

    They include rules #:
    7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,27,28,29,30,31,32,34,35,36,37,38,39,40,41,42,43,48,49,50,51,52,53

    You can disable these rules manually from Network Protection > Intrusion Prevention > Advanced: Modified Rules - click the + : enter in rules sid# (found in the bulk of the alerts) and click "Disable this rule". You can add the others as you see fit but they do need to be added one by one. 

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Children
No Data
Unfiltered HTML