Search for the message and #if (0) it out. ntop looks at the 1st few bytes and if it sees an http request on a non-standard port, that's what generates the message.
-----Burton ---------- Original Message ---------------------------------- From: "Mathew Davies" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Tue, 28 Oct 2003 12:18:09 -0000 > >I have been noticing a lot of warnings on ntop syslogs of the type below warning of a >trojan >which I am pretty sure are incorrect. > >If this is because I have a proxy server would this be the same if I was using >the proxy server on non standard port 4321 not squid default of 3128, if so can >I is there a way of teaching ntop this is ok? > >ntop[13929]: **WARNING** WARNING: HTTP detected at wrong port (trojan?) >internal_client_ip:1177 -> internal_proxyserver_ip:4321 >[GET http://www.flyaerlingus.com/css/webdeals.css HTTP/1.0^M Accept: >*/*^M Referer: http://www.aerlingus.ie/cgi-bin/obel01im1/index.jsp^M >Accept-Language: en-gb^M If-Modified-Since: Mon > >Mathew Davies > >________________________________________________________________________ >This e-mail has been scanned for all viruses by Star Internet. The >service is powered by MessageLabs. For more information on a proactive >anti-virus service working around the clock, around the globe, visit: >http://www.star.net.uk >________________________________________________________________________ >_______________________________________________ >Ntop mailing list >[EMAIL PROTECTED] >http://listgateway.unipi.it/mailman/listinfo/ntop > ____________________________________________________________ Free 20MB Web Site Hosting and Personalized E-mail Service! Get It Now At Doteasy.com http://www.doteasy.com/et/ _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
