Protocol Violation with Google IPs

Zeek
1

Hello Guys,

                   Anyone is having ProtocolViolation alarms with Google IPs? Analizying the packet trace I've noticed that either GMAIL or Google Talk is alerting Protocol Violation for the HTTP Analyzer.

t=1201268671.707425 no=ProtocolViolation na=NOTICE_ALARM_ALWAYS sa=x.x.x.x sp=1233/tcp da=209.85.171.86 dp=80/tcp msg=x.x.x.x/1233\ >\ 209.85.171.86/http\ analyzer\ HTTP\ disabled\ due\ to\ protocol\ violation sub=not\ a\ http\ reply\ line tag=@4792

Tks

2

I can look into it if you send me the trace (just the single
connection reported in the alarm please).

Robin