|
Mailing List Archive For snort-sigs@snort.org By Thread- Re: [Snort-sigs] I don't want scan.log Dan Monjar (29 Aug 2003)
- Re: [Snort-sigs] I don't want scan.log Mann E. Schevitz (28 Aug 2003)
- Re: [Snort-sigs] Classification.config frenzy(at)frenzy.org (29 Aug 2003)
- Re: [Snort-sigs] Quick Nachi ICMP rule -variants? Vincent Vono (29 Aug 2003)
- Re: [Snort-sigs] Quick Nachi ICMP rule -variants? Johnathan Norman (29 Aug 2003)
- [Snort-sigs] Real Networks vulnerability J-H. Johansen (29 Aug 2003)
- Re: [Snort-sigs] syn/fin scans from stream4 Erek Adams (29 Aug 2003)
- Re: [Snort-sigs] Quick Nachi ICMP rule -variants? Brian Howard (29 Aug 2003)
- Re: [Snort-sigs] Quick Nachi ICMP rule Johnathan Norman (28 Aug 2003)
- Re: [Snort-sigs] Quick Nachi ICMP rule Johnathan Norman (28 Aug 2003)
- RE: [Snort-sigs] syn/fin scans from stream4 Perry, Brian (28 Aug 2003)
- [Snort-sigs] syn/fin scans from stream4 Vincent Vono (28 Aug 2003)
- [Snort-sigs] I don't want scan.log Dan Monjar (28 Aug 2003)
- [Snort-sigs] MS-SQL Ping false positives David Wilburn (28 Aug 2003)
- [Snort-sigs] rule / doc change needed for CyberKit David Wilburn (28 Aug 2003)
- Re: [Snort-sigs] Limiting Alert Rates? Newbie Erek Adams (28 Aug 2003)
- Re: [Snort-sigs] Limiting Alert Rates? Newbie Tony Lill (27 Aug 2003)
- RE: [Snort-sigs] Possible new strain of Blaster or is it a false positive? Compton, Rich (27 Aug 2003)
- Re: [Snort-sigs] Limiting Alert Rates? Newbie Richard Crane (27 Aug 2003)
- RE: [Snort-sigs] Limiting Alert Rates? Newbie Michael Miller (27 Aug 2003)
- [Snort-sigs] Classification.config Williams, Colby E. (26 Aug 2003)
- Re: [Snort-sigs] Limiting Alert Rates? Newbie Erek Adams (26 Aug 2003)
- [Snort-sigs] Limiting Alert Rates? Newbie Jacob Roberts (26 Aug 2003)
- Re: [Snort-sigs] problems setting flags studentmm08.pool-id(at)daimlerchrysler.com (25 Aug 2003)
- Re: [Snort-sigs] change to sid 2189 (PIM) to account for MCAST-NET Jon Hart (23 Aug 2003)
- [Snort-sigs] change to sid 2189 (PIM) to account for MCAST-NET Jon Hart (23 Aug 2003)
- [Snort-sigs] Quick Nachi ICMP rule Paul Schmehl (22 Aug 2003)
- [Snort-sigs] Quick Sobig.f rule Paul Schmehl (22 Aug 2003)
- Re: [Snort-sigs] Possible new strain of Blaster or is it a false positive? Marty.Bostick(at)protective.com (22 Aug 2003)
- Re: [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknownkeyword 'established' in rule! Wes Young (21 Aug 2003)
- [Snort-sigs] problems setting flags studentmm08.pool-id(at)daimlerchrysler.com (22 Aug 2003)
- [Snort-sigs] Possible new strain of Blaster or is it a false positive? Marty.Bostick(at)protective.com (22 Aug 2003)
- [Snort-sigs] rule 1882 broken Bob Tito (22 Aug 2003)
- Re: [Snort-sigs] Rule for Sobig.F Hugo van der Kooij (22 Aug 2003)
- Re: [Snort-sigs] Rule for Sobig.F Jonathan Norman (22 Aug 2003)
- [Snort-sigs] Event log Signature for Slammer John Hally (20 Aug 2003)
- RE: [Snort-sigs] Lovegate Signature larosa, vjay (20 Aug 2003)
- [Snort-sigs] Lovegate Signature mos def (20 Aug 2003)
- Re: [Snort-sigs] Updated BLASTER TFTP rules Brian (20 Aug 2003)
- Re: [Snort-sigs] Updated BLASTER TFTP rules Jason Haar (20 Aug 2003)
- Re: [Snort-sigs] Updated BLASTER TFTP rules Erick Mechler (19 Aug 2003)
- Re: [Snort-sigs] Updated BLASTER TFTP rules Jason Haar (19 Aug 2003)
- Re: [Snort-sigs] Updated BLASTER TFTP rules Brian (20 Aug 2003)
- [Snort-sigs] Updated BLASTER TFTP rules Jason Haar (19 Aug 2003)
- [Snort-sigs] Rule for Sobig.F Shane Williams (19 Aug 2003)
- Re: [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknown keyword 'established' in rule! Chris Green (19 Aug 2003)
- Re: [Snort-sigs] Snorting without "flow:" Chris Green (19 Aug 2003)
- [Snort-sigs] SID 1250 James Affeld (19 Aug 2003)
- RE: (long, slightly OT) Re: [Snort-sigs] Blaster Alert-False Nega tive? Bartholomew, Brian J (18 Aug 2003)
- RE: [Snort-sigs] problem writing rules for checking traffic and content mad.eye(at)gmx.net (19 Aug 2003)
- [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. Colin.Slevin(at)transwareplc.com (18 Aug 2003)
- [Snort-sigs] Snorting without "flow:" Sean Batt (18 Aug 2003)
- [Snort-sigs] Marek Stiefenhofer ist nicht im Büro m.stiefenhofer(at)ecofis.de (18 Aug 2003)
- Re: [Snort-sigs] CYBERKIT [Full-Disclosure] [UPDATE] ping floods Hugo van der Kooij (18 Aug 2003)
- RE: [Snort-sigs] problem writing rules for checking traffic and c ontent Eric Baur (18 Aug 2003)
- RE: [Snort-sigs] Strange CyberKit alert activity Keith T. Morgan (18 Aug 2003)
- RE: [Snort-sigs] Strange CyberKit alert activity Bryan Irvine (18 Aug 2003)
- [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. Colin.Slevin(at)transwareplc.com (18 Aug 2003)
- [Snort-sigs] CYBERKIT [Full-Disclosure] [UPDATE] ping floods Steve Postma (18 Aug 2003)
- RE: [Snort-sigs] Strange CyberKit alert activity Yackley, Matt (18 Aug 2003)
- RE: [Snort-sigs] Strange CyberKit alert activity Robert Wagner (18 Aug 2003)
- RE: [Snort-sigs] Strange CyberKit alert activity Gavin Lowe (18 Aug 2003)
- RE: [Snort-sigs] Strange CyberKit alert activity Pacheco, Michael F. (18 Aug 2003)
- RE: [Snort-sigs] Strange CyberKit alert activity Pacheco, Michael F. (18 Aug 2003)
- Re: [Snort-sigs] Q about uricontent vs content ; web bot name Dale L. Handy (18 Aug 2003)
- [Snort-sigs] Strange CyberKit alert activity David Stubblefield (18 Aug 2003)
- [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknown keyword 'established' in rule! Jukka Juslin (18 Aug 2003)
- [Snort-sigs] problem writing rules for checking traffic and content studentmm08.pool-id(at)daimlerchrysler.com (18 Aug 2003)
- [Snort-sigs] 1378 sig docs Neal Timm (17 Aug 2003)
- [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. Colin.Slevin(at)transwareplc.com (17 Aug 2003)
- RE: [Snort-sigs] Blaster Alert-False Negative? Jade E. Deane (17 Aug 2003)
- [Snort-sigs] Q about uricontent vs content ; web bot name Michael Scheidell (17 Aug 2003)
- [Snort-sigs] Re: Is it possible to Log Headers not Data? Stuart Jenkins (16 Aug 2003)
- [Snort-sigs] Is it possible to Log Headers not Data? Stuart Jenkins (16 Aug 2003)
- [Snort-sigs] GPL/Open Source: Naieve Question Vkmobile (14 Aug 2003)
- Re: [Snort-sigs] snorting telnet caffeinex36(at)yahoo.com (15 Aug 2003)
- [Snort-sigs] snorting telnet Bryan Irvine (15 Aug 2003)
- Re: [Snort-sigs] GPL/Open Source: Naieve Question James Riden (14 Aug 2003)
- Re: [Snort-sigs] Possible new trojan Matt Kettler (14 Aug 2003)
- [Snort-sigs] Blaster/Lovosan Rules Gregor Domhan (14 Aug 2003)
- (long, slightly OT) Re: [Snort-sigs] Blaster Alert-False Negative? JP Vossen (15 Aug 2003)
- [Snort-sigs] Web Traffic Logging Travis Rodak (15 Aug 2003)
- [Snort-sigs] tftp msblast.exe rule Kaufman, Adam (15 Aug 2003)
- RE: [Snort-sigs] Blaster Alert-False Negative? lordchariot(at)earthlink.net (14 Aug 2003)
- Re: [Snort-sigs] Blaster Alert-False Negative? Michael Scheidell (14 Aug 2003)
- RE: [Snort-sigs] Can someone please repost a sig for MS Blaster? Parker, Ian (14 Aug 2003)
- Re: [Snort-sigs] Blaster Alert-False Negative? James Riden (14 Aug 2003)
- [Snort-sigs] Blaster Alert-False Negative? Bartholomew, Brian J (13 Aug 2003)
- Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? Nigel Houghton (13 Aug 2003)
- Re: [Snort-sigs] Sig file for W32.Blaster.Worm? Erick Mechler (13 Aug 2003)
- [Snort-sigs] Sig file for W32.Blaster.Worm? Jason Antonacci (13 Aug 2003)
- Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? Joe Stewart (13 Aug 2003)
- Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? Erick Mechler (13 Aug 2003)
- Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? Marty.Bostick(at)protective.com (13 Aug 2003)
- Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? daniel uriah clemens (13 Aug 2003)
- Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? Alex Burger (13 Aug 2003)
- [Snort-sigs] Can someone please repost a sig for MS Blaster? Eric Joe (13 Aug 2003)
- [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? Marty.Bostick(at)protective.com (13 Aug 2003)
- RE: [Snort-sigs] fault positives Joshua Wright (13 Aug 2003)
- Re: [Snort-sigs] Re: Snort sign for Microsoft DCOM RPC Worm Alert Jason (13 Aug 2003)
- [Snort-sigs] fault positives studentmm08.pool-id(at)daimlerchrysler.com (13 Aug 2003)
- RE: FW: [Snort-sigs] DCom RPC attack response sig Sewell, Michael K (12 Aug 2003)
- [Snort-sigs] fault positives studentmm08.pool-id(at)daimlerchrysler.com (13 Aug 2003)
- Re: FW: [Snort-sigs] DCom RPC attack response sig Chris Kronberg (13 Aug 2003)
- Re: FW: [Snort-sigs] DCom RPC attack response sig Bennett Todd (12 Aug 2003)
- RE: FW: [Snort-sigs] DCom RPC attack response sig Chris Kronberg (12 Aug 2003)
- RE: FW: [Snort-sigs] DCom RPC attack response sig Tech (12 Aug 2003)
- [Snort-sigs] Re: Snort sign for Microsoft DCOM RPC Worm Alert IntegPatchMgr (12 Aug 2003)
- Re: FW: [Snort-sigs] DCom RPC attack response sig Pogue (12 Aug 2003)
- [Snort-sigs] src or dst port alejandro corletti (11 Aug 2003)
- [Snort-sigs] Blaster Worm Signature?? DasPadre(at)aol.com (12 Aug 2003)
- [Snort-sigs] RE: Snort-sigs digest, Vol 1 #670 - 1 msg Vuppala, Vijaybhasker (EM, GECIS) (12 Aug 2003)
- Re: [Snort-sigs] DCom RPC attack response sig CK Ng (07 Aug 2003)
- Re: [Snort-sigs] Signature Timestamp? JP Vossen (09 Aug 2003)
- Re: [Snort-sigs] Signature Timestamp? Dusty Hall (08 Aug 2003)
- [Snort-sigs] RE: Snort-sigs digest, Vol 1 #667 - 4 msgs SG-Chew Poh Chang (07 Aug 2003)
- Re: [Snort-sigs] Signature Timestamp? Matt Kettler (07 Aug 2003)
- [Snort-sigs] Signature Timestamp? Dusty Hall (07 Aug 2003)
- [Snort-sigs] AIM Express sigs Alan Kloster (07 Aug 2003)
- Re: [Snort-sigs] Snort rules am attaching the files Nigel Houghton (06 Aug 2003)
- [Snort-sigs] Documentation: sid 1791 Steven Alexander (06 Aug 2003)
- Re: [Snort-sigs] Snort rules am attaching the files Erek Adams (06 Aug 2003)
- [Snort-sigs] Compaq Insight Management Agent Rich Adamson (06 Aug 2003)
- [Snort-sigs] Snort Sigs Documents Neal Timm (06 Aug 2003)
- Re: [Snort-sigs] RESERVED IP and Broadcast address Michael Scheidell (06 Aug 2003)
- [Snort-sigs] RESERVED IP and Broadcast address Peter Millington (06 Aug 2003)
- RE: [Snort-sigs] DCom RPC attack response sig Michael Anuzis (05 Aug 2003)
- [Snort-sigs] [Fwd: Re: [Dragonidsuser] W32/Mimail Signature] Burak DAYIOGLU (06 Aug 2003)
- [Snort-sigs] Rule Update Altrock, Jens (01 Aug 2003)
- [Snort-sigs] Sig for Grim's Ping FTP scanner tool JP Vossen (02 Aug 2003)
- [Snort-sigs] More DCOM sigs JP Vossen (01 Aug 2003)
- [Snort-sigs] Robin Smits/NL/GTS/PwC is out of the office. robin.smits(at)nl.pwc.com (01 Aug 2003)
|
