ET POLICY HTTP traffic on port 443 (POST)
-
Seeing a ton of blocked connections (95% of my Snort logs) from 54.215.136.238, which resolves to ec2-54-215-136-238.us-west-1.compute.amazonaws.com
The alert generated is: ET POLICY HTTP traffic on port 443 (POST)
Any idea what this could be?
-
This alert is basically saying "I saw unencrypted HTTP traffic travelling over a port generally reserved for HTTPS encrypted traffic". It is more of a notification/warning as opposed to an alert about truly malicious activity. You could safely disable that rule if you wish.
Bill
-
You could safely disable that rule if you wish.
Bear in mind that if you decide to allow HTTP traffic on 443, all the rules with $HTTP_PORTS wont be inspecting that traffic. Unless you add 443 to the $HTTP_PORTS variable, which will cause other false positive with some HTTPS inspection. In other word, the way alot of rules are made, HTTP, non encrypted traffic, shouldnt be on 443
F.
