Mailing List Archive For snort-sigs@snort.org May 2003 By Thread

• [Snort-sigs] Re: Proposed change to icmp-info.rules Jim Breton (Sat May 31 2003 - 15:53:37 EDT)
• RE: [Snort-sigs] spp_stream4 Steath activity John Hally (Fri May 30 2003 - 17:19:09 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Fri May 30 16:15:18 2003 bmc(at)snort.org (Fri May 30 2003 - 16:15:18 EDT)
• [Snort-sigs] snort-rules STABLE update @ Fri May 30 16:15:18 2003 bmc(at)snort.org (Fri May 30 2003 - 16:15:18 EDT)
• [Snort-sigs] Re: [Snort-users] byte_test:5,<,65537,0,relative,string; Brian (Fri May 30 2003 - 15:43:02 EDT)
• Re: [Snort-sigs] spp_stream4 Steath activity daniel.clemens (Fri May 30 2003 - 09:40:59 EDT)
• [Snort-sigs] spp_stream4 Steath activity John Hally (Fri May 30 2003 - 14:36:49 EDT)
• [Snort-sigs] Maintain virus.rules Kevin Binsfield (Fri May 30 2003 - 10:42:42 EDT)
• [Snort-sigs] byte_test:5,<,65537,0,relative,string; Martin Olsson (Fri May 30 2003 - 03:06:47 EDT)
• Re: [Snort-sigs] How detect relaying with qmail and snort ? daniel.clemens (Thu May 29 2003 - 08:53:52 EDT)
• [Snort-sigs] How detect relaying with qmail and snort ? r2d2r4(at)crusoecids.dyndns.org (Wed May 28 2003 - 12:49:03 EDT)
• [Snort-sigs] Re: Signatures related to POP3 overflow attempt Nate Haggard (Wed May 28 2003 - 12:33:30 EDT)
• [Snort-sigs] Proposed change to icmp-info.rules Jim Breton (Wed May 28 2003 - 14:01:39 EDT)
• [Snort-sigs] Detecting Connections Faiz Ahmad Shuja (Thu May 29 2003 - 04:29:25 EDT)
• Re: [Snort-sigs] snort_decoder T/TCP detected Dirk Mueller (Wed May 28 2003 - 14:44:14 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Wed May 28 14:16:41 2003 bmc(at)snort.org (Wed May 28 2003 - 14:16:41 EDT)
• [Snort-sigs] snort_decoder T/TCP detected Vincent Vono (Wed May 28 2003 - 14:15:46 EDT)
• [Snort-sigs] snort-rules STABLE update @ Wed May 28 14:16:41 2003 bmc(at)snort.org (Wed May 28 2003 - 14:16:41 EDT)
• Re: [Snort-sigs] dropping traffic Erek Adams (Wed May 28 2003 - 11:57:59 EDT)
• Re: [Snort-sigs] Nimda Brian (Wed May 28 2003 - 11:56:11 EDT)
• [Snort-sigs] SID 1882 False Posiitives : "ATTACK-RESPONSES id check returned userid " SoloNet Newsfeed Processor (Wed May 28 2003 - 10:56:01 EDT)
• [Snort-sigs] dropping traffic Esler, Joel Contractor (Wed May 28 2003 - 09:52:17 EDT)
• RE: [Snort-sigs] Nimda Joe Kinsella (Wed May 28 2003 - 08:52:58 EDT)
• Re: [Snort-sigs] Nimda Nigel Houghton (Tue May 27 2003 - 20:10:21 EDT)
• Re: [Snort-sigs] general sig question Erek Adams (Tue May 27 2003 - 19:12:21 EDT)
• Re: [Snort-sigs] general sig question Tom Arseneault (Tue May 27 2003 - 18:45:35 EDT)
• Re: [Snort-sigs] Nimda Matt Kettler (Tue May 27 2003 - 18:00:25 EDT)
• [Snort-sigs] Nimda Joe Kinsella (Tue May 27 2003 - 16:42:00 EDT)
• Re: [Snort-sigs] SMTP rcpt to sed command attempt Matt Kettler (Tue May 27 2003 - 15:05:26 EDT)
• Re: [Snort-sigs] DNS poisoning Matt Kettler (Tue May 27 2003 - 14:40:44 EDT)
• [Snort-sigs] ELKERN Signature? Lorraine Cannavale (Tue May 27 2003 - 13:55:54 EDT)
• [Snort-sigs] DNS poisoning Vincent Vono (Tue May 27 2003 - 12:00:52 EDT)
• [Snort-sigs] problem with double logging Marco Agostani (Fri May 23 2003 - 06:46:07 EDT)
• [Snort-sigs] Possible false positive on SID 663 McKinlay, Ken (Tue May 27 2003 - 09:35:44 EDT)
• RE: [Snort-sigs] Look for attached files? Andrew Hintz \(Drew\) (Sun May 25 2003 - 21:28:43 EDT)
• [Snort-sigs] Look for attached files? Magnus Larsson (Sun May 25 2003 - 06:23:51 EDT)
• [Snort-sigs] SMTP rcpt to sed command attempt Tony Lill (Sat May 24 2003 - 23:24:15 EDT)
• Re: [Snort-sigs] general sig question Brian (Thu May 22 2003 - 08:00:28 EDT)
• Re: [Snort-sigs] Not looking in Email security people (Thu May 22 2003 - 07:54:43 EDT)
• [Snort-sigs] general sig question d_greenjr (Thu May 22 2003 - 02:03:17 EDT)
• Re: [Snort-sigs] Not looking in Email Dale L. Handy (Wed May 21 2003 - 23:45:16 EDT)
• Re: [Snort-sigs] Not looking in Email security people (Wed May 21 2003 - 23:30:59 EDT)
• RE: [Snort-sigs] Not looking in Email Esler, Joel Contractor (Wed May 21 2003 - 23:23:09 EDT)
• [Snort-sigs] Not looking in Email Esler, Joel Contractor (Wed May 21 2003 - 22:16:36 EDT)
• Re: [Snort-sigs] hi Chris Baker (Wed May 21 2003 - 09:53:45 EDT)
• RE: [Snort-sigs] Virus sig for worm_palyh.a and pe_ganda.a? Shane Williams (Wed May 21 2003 - 09:36:07 EDT)
• [Snort-sigs] hi pix (Wed May 21 2003 - 05:44:40 EDT)
• RE: [Snort-sigs] Virus sig for worm_palyh.a and pe_ganda.a? Burak DAYIOGLU (Wed May 21 2003 - 01:18:46 EDT)
• RE: [Snort-sigs] Ultimate Rule List Moyer, Shawn (Wed May 21 2003 - 00:03:13 EDT)
• Re: [Snort-sigs] Virus sig for worm_palyh.a and pe_ganda.a? .....can you give me some pointers. (fwd) Dale L. Handy (Tue May 20 2003 - 17:44:52 EDT)
• RE: [Snort-sigs] Virus sig for worm_palyh.a and pe_ganda.a? Magnus Larsson (Tue May 20 2003 - 13:56:58 EDT)
• Re: [Snort-sigs] install.php?phpbb_root_dir=http:// sig? Brian (Tue May 20 2003 - 11:45:25 EDT)
• RE: [Snort-sigs] Virus sig for worm_palyh.a and pe_ganda.a? .....can you give me some pointers. (fwd) daniel.clemens (Tue May 20 2003 - 06:25:05 EDT)
• RE: [Snort-sigs] Virus sig for worm_palyh.a and pe_ganda.a? Robert Reid (Tue May 20 2003 - 11:04:45 EDT)
• [Snort-sigs] Snort & Acid Colin.Slevin(at)transwareplc.com (Tue May 20 2003 - 06:59:56 EDT)
• [Snort-sigs] install.php?phpbb_root_dir=http:// sig? Eric Appelboom (Tue May 20 2003 - 07:21:13 EDT)
• [Snort-sigs] Followup on my last virus question. Magnus Larsson (Tue May 20 2003 - 04:00:55 EDT)
• [Snort-sigs] Sig for a old virus? Magnus Larsson (Tue May 20 2003 - 03:54:24 EDT)
• Re: [Snort-sigs] Virus sig for worm_palyh.a and pe_ganda.a? Shane Williams (Mon May 19 2003 - 17:26:50 EDT)
• [Snort-sigs] Virus sig for worm_palyh.a and pe_ganda.a? Magnus Larsson (Mon May 19 2003 - 13:03:16 EDT)
• Re: [Snort-sigs] Ultimate Rule List David Wilburn (Mon May 19 2003 - 12:55:05 EDT)
• Re: [Snort-sigs] VIRUS_RULES Matt Kettler (Mon May 19 2003 - 10:43:08 EDT)
• [Snort-sigs] Ultimate Rule List Greg Powell (Mon May 19 2003 - 10:47:25 EDT)
• Re: [Snort-sigs] Issue.fixing wincap Joesph Bowling (Fri May 16 2003 - 16:25:43 EDT)
• Re: [Snort-sigs] Issue Matt Kettler (Fri May 16 2003 - 14:40:36 EDT)
• Fw: [Snort-sigs] Signatures related to POP3 overflow attempt operator (Fri May 16 2003 - 09:22:28 EDT)
• Re: [Snort-sigs] Signatures related to POP3 overflow attempt operator (Fri May 16 2003 - 09:15:17 EDT)
• [Snort-sigs] VIRUS_RULES Bill Leinauer (Thu May 15 2003 - 10:26:16 EDT)
• [Snort-sigs] Issue Colin.Slevin(at)transwareplc.com (Fri May 16 2003 - 07:19:16 EDT)
• [Snort-sigs] snort-rules STABLE update @ Thu May 15 23:15:23 2003 bmc(at)snort.org (Thu May 15 2003 - 23:15:23 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Thu May 15 23:15:23 2003 bmc(at)snort.org (Thu May 15 2003 - 23:15:23 EDT)
• [Snort-sigs] Signatures related to POP3 overflow attempt Erik Alexander Løkken (Thu May 15 2003 - 18:45:17 EDT)
• [Snort-sigs] SID 663 - Revision 6 - False Positives question Erik Alexander Løkken (Thu May 15 2003 - 18:35:16 EDT)
• [Snort-sigs] SID 1620, Non-Standard IP Protocol question Daniel Reich (Thu May 15 2003 - 11:39:09 EDT)
• RE: [Snort-sigs] snort 2.0 problems Joesph Bowling (Wed May 14 2003 - 20:30:19 EDT)
• RE: [Snort-sigs] Does anyone have a working set of rules for the Fizzer Worm Tinsley Paul (Wed May 14 2003 - 18:37:25 EDT)
• [Snort-sigs] snort-rules STABLE update @ Wed May 14 17:15:36 2003 bmc(at)snort.org (Wed May 14 2003 - 17:15:36 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Wed May 14 17:15:36 2003 bmc(at)snort.org (Wed May 14 2003 - 17:15:36 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Wed May 14 14:14:32 2003 bmc(at)snort.org (Wed May 14 2003 - 14:14:32 EDT)
• [Snort-sigs] snort-rules STABLE update @ Wed May 14 14:14:32 2003 bmc(at)snort.org (Wed May 14 2003 - 14:14:33 EDT)
• [Snort-sigs] Does anyone have a working set of rules for the Fizzer Worm Marty.Bostick(at)protective.com (Wed May 14 2003 - 16:26:36 EDT)
• [Snort-sigs] RE: [Snort-users] Fizzer Virus Signature operator (Wed May 14 2003 - 13:01:01 EDT)
• [Snort-sigs] Question Joe Hdez (Tue May 13 2003 - 17:34:45 EDT)
• Re: [Snort-sigs] Re: Snort-sigs digest, Vol 1 #573 - 12 msgs Hugo van der Kooij (Wed May 14 2003 - 02:32:27 EDT)
• [Snort-sigs] naming of rules file Liuhy (Wed May 14 2003 - 01:40:29 EDT)
• Re: [Snort-sigs] Re: Snort-sigs digest, Vol 1 #573 - 12 msgs Brian (Tue May 13 2003 - 23:03:03 EDT)
• [Snort-sigs] Re: Snort-sigs digest, Vol 1 #573 - 12 msgs Jose Ramon Hernandez Macias (Tue May 13 2003 - 17:08:53 EDT)
• Re: [Snort-sigs] WebDav exploits - individual signatures Joe Stewart (Tue May 13 2003 - 15:36:02 EDT)
• [Snort-sigs] snort-rules STABLE update @ Tue May 13 11:03:45 2003 bmc(at)snort.org (Tue May 13 2003 - 11:03:45 EDT)
• RE: [Snort-sigs] snort 2.0 problems Smith, Jim (Tue May 13 2003 - 09:44:34 EDT)
• [Snort-sigs] RE-Announcing sp_perl Brian (Tue May 13 2003 - 09:48:56 EDT)
• [Snort-sigs] WebDav exploits - individual signatures Joe Stewart (Tue May 13 2003 - 09:42:43 EDT)
• [Snort-sigs] snort 2.0 problems Randall S Jew (Mon May 12 2003 - 11:16:45 EDT)
• Re: [Snort-sigs] Announcing sp_perl Chris Green (Mon May 12 2003 - 09:05:50 EDT)
• [Snort-sigs] Announcing sp_perl Jeff Nathan (Sat May 10 2003 - 06:48:47 EDT)
• [Snort-sigs] ICMP rules: sid 499,473, 477, 487 m(at)xx (Thu May 08 2003 - 11:16:07 EDT)
• Re: [Snort-sigs] Snort attack -- was disable /var/log/snort logging Bill McCarty (Fri May 09 2003 - 03:23:23 EDT)
• Re: [Snort-sigs] disable /var/log/snort logging Bill McCarty (Fri May 09 2003 - 00:58:41 EDT)
• Re: [Snort-sigs] Netbios rules are case sensitive? Jason Haar (Thu May 08 2003 - 16:34:51 EDT)
• Re: [Snort-sigs] MESSNGR SPAM Sig Phil Lyons (Thu May 08 2003 - 11:03:54 EDT)
• RE: [Snort-sigs] disable /var/log/snort logging Nick White (Wed May 07 2003 - 19:54:39 EDT)
• Re: [Snort-sigs] MESSNGR SPAM Sig Brian (Wed May 07 2003 - 19:05:34 EDT)
• Re: [Snort-sigs] MESSNGR SPAM Sig Gary Flynn (Wed May 07 2003 - 17:51:31 EDT)
• Re: [Snort-sigs] disable /var/log/snort logging Matt Kettler (Wed May 07 2003 - 17:20:11 EDT)
• Re: [Snort-sigs] MESSNGR SPAM Sig Brian (Wed May 07 2003 - 16:56:26 EDT)
• [Snort-sigs] disable /var/log/snort logging Nick White (Wed May 07 2003 - 14:25:45 EDT)
• Re: [Snort-sigs] Snort rule sorter or managment system Horacio Falcon (Wed May 07 2003 - 12:16:47 EDT)
• [Snort-sigs] SMTP ETRN overflow attempt NO JUNK MAIL (Tue May 06 2003 - 12:37:20 EDT)
• [Snort-sigs] Snort rule sorter or managment system Tim Bates (Wed May 07 2003 - 10:33:18 EDT)
• [Snort-sigs] test mail Liuhy (Wed May 07 2003 - 03:58:52 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Tue May 6 20:15:27 2003 bmc(at)snort.org (Tue May 06 2003 - 20:15:27 EDT)
• [Snort-sigs] filter session in both direction Jingmin (Jimmy) Zhou (Tue May 06 2003 - 19:25:33 EDT)
• RE: [Snort-sigs] MESSNGR SPAM Sig Phil Lyons (Tue May 06 2003 - 18:12:00 EDT)
• RE: [Snort-sigs] MESSNGR SPAM Sig O'Flynn, Derek (Tue May 06 2003 - 17:09:59 EDT)
• RE: [Snort-sigs] MESSNGR SPAM Sig O'Flynn, Derek (Tue May 06 2003 - 16:58:39 EDT)
• [Snort-sigs] MESSNGR SPAM Sig Phil Lyons (Tue May 06 2003 - 16:32:11 EDT)
• [Snort-sigs] SQL Intection sig Eric Appelboom (Tue May 06 2003 - 07:38:49 EDT)
• [Snort-sigs] UNIXSOCK Mattia (Mon May 05 2003 - 11:16:18 EDT)
• Re: [Snort-sigs] Not sure I understand "RPC AMD TCP pid request".. Brian (Sun May 04 2003 - 13:00:51 EDT)
• Re: [Snort-sigs] Netbios rules are case sensitive? Brian (Sun May 04 2003 - 13:03:18 EDT)
• Re: [Snort-sigs] Bad reference on SID: 598? Brian (Sun May 04 2003 - 12:45:18 EDT)
• [Snort-sigs] Bad reference on SID: 598? JP Vossen (Sun May 04 2003 - 02:32:13 EDT)
• [Snort-sigs] Not sure I understand "RPC AMD TCP pid request".. Tom Arseneault (Fri May 02 2003 - 18:55:54 EDT)
• [Snort-sigs] 1631 CHAT AIM login false positive Terence Runge (Fri May 02 2003 - 17:57:05 EDT)
• RE: [Snort-sigs] Netbios rules are case sensitive? Jon Stearn (Thu May 01 2003 - 05:43:04 EDT)