** Attachment added: "Snort tcpdump logs, Debug::Acquire::http=true output" http://launchpadlibrarian.net/16853085/C%3A%5CDocuments%20and%20Settings%5CcharneDN%5CDesktop%5Captbug.tar.bz2
** Description changed: Binary package hint: apt I've been getting "Invalid HTTP Version String" messages ever since I installed Snort. I originally thought this problem was something to do with my Apache config (http://ubuntuforums.org/showthread.php?t=888625) but I have since been able to confirm that the problem is apt-get update. The following was made by running the /etc/cron.daily/5snort cronjob as root both immediately before and immediately after an apt-get update: >>>>> Events between 08 15 09:27:19 and 08 15 09:27:21 Total events: 21 Signatures recorded: 1 Source IP recorded: 1 Destination IP recorded: 4 Events from same host to same destination using same method ========================================================================= # of from to method ========================================================================= 8 10.212.1.13 91.189.88.31 WEB-MISC Invalid HTTP Version String 5 10.212.1.13 91.189.88.37 WEB-MISC Invalid HTTP Version String 4 10.212.1.13 91.189.90.142 WEB-MISC Invalid HTTP Version String 4 10.212.1.13 88.198.22.52 WEB-MISC Invalid HTTP Version String <<<<< The attachment contains the associated tcpdump log from snort, as well as the output of "sudo apt-get update -o Debug::Acquire::http=true 2> /tmp/apt-fetch.log" Possibly, this bug is related to https://bugs.launchpad.net/ubuntu/+source/apt/+bug/26083, but as the symptoms are different (I don't get the "Err...bad header line" message - from apt.) + from apt.) I thought I'd file a new one. Since I no longer have Debian installed anywhere, I can't check whether or not this is an upstream problem. Sorry. [EMAIL PROTECTED]:~# lsb_release -rd Description: Ubuntu 8.04.1 Release: 8.04 [EMAIL PROTECTED]:~# apt-cache policy apt apt: Installed: 0.7.9ubuntu17 Candidate: 0.7.9ubuntu17 Version table: *** 0.7.9ubuntu17 0 500 http://us.archive.ubuntu.com hardy/main Packages 100 /var/lib/dpkg/status [EMAIL PROTECTED]:~# -- apt-get update causes "WEB-MISC Invalid HTTP Version String" warning in Snort https://bugs.launchpad.net/bugs/258155 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
