<snip> Im getting some alerts from a ip that we all know and love. Security Focus. Has any one gotten the same results or has any ides on why this would be happening? </snip>
False positive. If you check the packet, I think you will find that someone mentioned whatever triggers that rule in email. If you are on security lists, this is common. Whenever anyone sends an email to the snort signatures list, I usually get an alert. Check the packet. Jason Lewis http://www.packetnexus.com It's not secure "Because they told me it was secure". The people at the other end of the link know less about security than you do. And that's scary.
