Mailing List Archive For snort-sigs@snort.org Jun 2003 By Thread

• [Snort-sigs] Nemesis 1.4 beta3 released Jeff Nathan (Mon Jun 30 2003 - 14:25:55 EDT)
• Re: [Snort-sigs] nocase Brian (Fri Jun 27 2003 - 18:53:51 EDT)
• Re: [Snort-sigs] Signaure Hiccup stephane (Fri Jun 27 2003 - 15:30:55 EDT)
• [Snort-sigs] W32.Mumu.B.Worm Patterns (BETA) Tinsley Paul (Fri Jun 27 2003 - 11:04:14 EDT)
• RE: [Snort-sigs] WinXP remote desktop rules--newbie help John York (Fri Jun 27 2003 - 10:40:03 EDT)
• Re: [Snort-sigs] Sobig.E variant Wes Young (Fri Jun 27 2003 - 09:34:41 EDT)
• [Snort-sigs] Re: nocase nick black (Thu Jun 26 2003 - 18:10:32 EDT)
• Re: [Snort-sigs] SID 2161 Nigel Houghton (Thu Jun 26 2003 - 11:25:58 EDT)
• Re: [Snort-sigs] WinXP remote desktop rules--newbie help Andreas Östling (Fri Jun 27 2003 - 03:52:01 EDT)
• [Snort-sigs] WinXP remote desktop rules--newbie help John York (Thu Jun 26 2003 - 17:05:23 EDT)
• Re: [Snort-sigs] Sobig.E variant Joe Stewart (Thu Jun 26 2003 - 16:45:57 EDT)
• RE: [Snort-sigs] Sobig.E variant Shane Williams (Thu Jun 26 2003 - 16:43:56 EDT)
• [Snort-sigs] Signaure Hiccup Dale L. Handy (Thu Jun 26 2003 - 15:58:34 EDT)
• RE: [Snort-sigs] Sobig.E variant Esler, Joel Contractor (Thu Jun 26 2003 - 14:43:19 EDT)
• [Snort-sigs] False Positive for SID 1322: bad frag bits Sam Gorton (Thu Jun 26 2003 - 14:53:32 EDT)
• RE: [Snort-sigs] Sobig.E variant Steven Alexander (Thu Jun 26 2003 - 14:26:31 EDT)
• [Snort-sigs] Sobig.E variant Esler, Joel Contractor (Thu Jun 26 2003 - 13:51:02 EDT)
• RE: [Snort-sigs] Edonkey - port 4662 O'Flynn, Derek (Thu Jun 26 2003 - 12:46:50 EDT)
• Re: [Snort-sigs] Edonkey - port 4662 Gustavo Beltrami Rossi (Thu Jun 26 2003 - 12:19:50 EDT)
• Re: [Snort-sigs] Edonkey - port 4662 Joe Matusiewicz (Thu Jun 26 2003 - 11:53:27 EDT)
• Re: [Snort-sigs] Edonkey - port 4662 Gustavo Beltrami Rossi (Thu Jun 26 2003 - 11:07:32 EDT)
• [Snort-sigs] SID 2161 Sam Evans (Thu Jun 26 2003 - 10:17:49 EDT)
• [Snort-sigs] Edonkey - port 4662 O'Flynn, Derek (Wed Jun 25 2003 - 17:33:12 EDT)
• [Snort-sigs] nocase Martin Olsson (Wed Jun 25 2003 - 07:36:58 EDT)
• [Snort-sigs] New rule: SCAN 55808 Trojan scan m.stiefenhofer(at)ecofis.de (Wed Jun 25 2003 - 07:14:58 EDT)
• [Snort-sigs] More documents in waiting Nigel Houghton (Tue Jun 24 2003 - 13:37:44 EDT)
• Re: [Snort-sigs] Rule Documentation - Rules of engagement Nigel Houghton (Tue Jun 24 2003 - 12:35:28 EDT)
• RE: [Snort-sigs] Rule Documentation - Rules of engagement Esler, Joel Contractor (Tue Jun 24 2003 - 11:49:50 EDT)
• [Snort-sigs] Wrm.exe, Backdoor.Wollf.16 (AVP) Fenstermaker, William (Tue Jun 24 2003 - 11:54:55 EDT)
• [Snort-sigs] Rule Documentation - Rules of engagement Nigel Houghton (Tue Jun 24 2003 - 11:03:14 EDT)
• [Snort-sigs] remove me from your list Carmit Partoush (Tue Jun 24 2003 - 10:27:34 EDT)
• [Snort-sigs] help about snort_inline Fang Neco (Mon Jun 23 2003 - 14:57:37 EDT)
• [Snort-sigs] Documentation: SID 274 Steven Alexander (Mon Jun 23 2003 - 18:40:56 EDT)
• [Snort-sigs] SID 295-299 Steven Alexander (Mon Jun 23 2003 - 18:39:45 EDT)
• [Snort-sigs] SID 295 Steven Alexander (Mon Jun 23 2003 - 18:01:30 EDT)
• Re: [Snort-sigs] Problems with SID 2161 Sam Evans (Mon Jun 23 2003 - 17:55:34 EDT)
• RE: [Snort-sigs] Problems with SID 2161 Sam Evans (Mon Jun 23 2003 - 17:51:35 EDT)
• Re: [Snort-sigs] Problems with SID 2161 Brian (Mon Jun 23 2003 - 17:21:42 EDT)
• Re: [Snort-sigs] logical operators and snort rules Brian (Mon Jun 23 2003 - 15:24:14 EDT)
• RE: [Snort-sigs] Problems with SID 2161 Steven Alexander (Mon Jun 23 2003 - 14:26:21 EDT)
• [Snort-sigs] Problems with SID 2161 Sam Evans (Mon Jun 23 2003 - 13:37:17 EDT)
• Re: [Snort-sigs] Question about rule semantic Brian (Mon Jun 23 2003 - 11:04:57 EDT)
• [Snort-sigs] new user group C L Dokic (Fri Jun 20 2003 - 11:07:13 EDT)
• [Snort-sigs] Deleted Rules Nigel Houghton (Sat Jun 21 2003 - 23:37:42 EDT)
• [Snort-sigs] Document for Rule 268 DOS Jolt attack U.Siva Kumar (Fri Jun 20 2003 - 23:46:26 EDT)
• [Snort-sigs] Documentation: SID 268 U.Siva Kumar (Fri Jun 20 2003 - 23:52:37 EDT)
• [Snort-sigs] Documentation: SID 629 Steven Alexander (Fri Jun 20 2003 - 12:50:53 EDT)
• [Snort-sigs] Documentation: SID 355 Steven Alexander (Fri Jun 20 2003 - 12:25:33 EDT)
• [Snort-sigs] Documentation: SID 293 Steven Alexander (Fri Jun 20 2003 - 12:06:32 EDT)
• [Snort-sigs] Documentation: SID 286 Steven Alexander (Fri Jun 20 2003 - 12:03:02 EDT)
• [Snort-sigs] Documentation: SID 290 Steven Alexander (Fri Jun 20 2003 - 12:05:11 EDT)
• [Snort-sigs] Documentation: SID 289 Steven Alexander (Fri Jun 20 2003 - 12:04:47 EDT)
• [Snort-sigs] Documentation: SID 287 Steven Alexander (Fri Jun 20 2003 - 12:03:33 EDT)
• [Snort-sigs] Documentation SID 291 Steven Alexander (Fri Jun 20 2003 - 12:06:13 EDT)
• [Snort-sigs] Documentation: SID 288 Steven Alexander (Fri Jun 20 2003 - 12:04:03 EDT)
• [Snort-sigs] SID 291 Steven Alexander (Fri Jun 20 2003 - 11:56:34 EDT)
• [Snort-sigs] PID Terence Garland (Nashua Connect) (Fri Jun 20 2003 - 07:48:42 EDT)
• RE: [Snort-sigs] sigs for MSM via proxies Ciprian Badescu (Fri Jun 20 2003 - 10:11:03 EDT)
• Re: [Snort-sigs] snort rules. Nigel Houghton (Fri Jun 20 2003 - 10:02:43 EDT)
• RE: [Snort-sigs] sigs for MSM via proxies Tinsley Paul (Fri Jun 20 2003 - 09:15:22 EDT)
• [Snort-sigs] sigs for MSM via proxies Jason Haar (Thu Jun 19 2003 - 18:43:44 EDT)
• [Snort-sigs] logical operators and snort rules Terence Runge (Thu Jun 19 2003 - 18:40:16 EDT)
• [Snort-sigs] categorizing snort signatures karim hassib (Thu Jun 19 2003 - 18:10:51 EDT)
• [Snort-sigs] false positives for MISC BGP invalid length Josh.Sakofsky(at)donovandata.com (Thu Jun 19 2003 - 14:29:25 EDT)
• Re: [Snort-sigs] Submit new detection engine? daniel.clemens (Thu Jun 19 2003 - 07:26:51 EDT)
• [Snort-sigs] SID 111 Liss, John (Wed Jun 18 2003 - 18:54:29 EDT)
• [Snort-sigs] SID 114 Liss, John (Wed Jun 18 2003 - 19:03:54 EDT)
• [Snort-sigs] Submit new detection engine? Neal (Tue Jun 17 2003 - 12:49:38 EDT)
• [Snort-sigs] snort rules. Randy C. Ramsdell (Wed Jun 18 2003 - 18:48:00 EDT)
• [Snort-sigs] SNORT Rowley, Thomas (Thu Jun 19 2003 - 11:13:00 EDT)
• [Snort-sigs] Question about rule semantic stephane (Tue Jun 17 2003 - 17:11:30 EDT)
• [Snort-sigs] Re: Depth and multi content rule help. nick black (Tue Jun 17 2003 - 18:07:21 EDT)
• [Snort-sigs] Successful anonymous ftp login rules... darrell hyde (Wed Jun 18 2003 - 07:57:05 EDT)
• Re: [Snort-sigs] Depth and multi content rule help. Chris Green (Wed Jun 18 2003 - 10:17:08 EDT)
• RE: [Snort-sigs] Duplicate sids in deleted.rules Andreas Östling (Tue Jun 17 2003 - 15:08:38 EDT)
• [Snort-sigs] Depth and multi content rule help. larosa, vjay (Tue Jun 17 2003 - 14:19:59 EDT)
• RE: [Snort-sigs] Duplicate sids in deleted.rules Schmehl, Paul L (Tue Jun 17 2003 - 14:12:53 EDT)
• RE: [Snort-sigs] Traceroute test Esler, Joel Contractor (Tue Jun 17 2003 - 13:43:11 EDT)
• RE: [Snort-sigs] Traceroute test Esler, Joel Contractor (Tue Jun 17 2003 - 13:22:45 EDT)
• Re: [Snort-sigs] Traceroute test Dirk Mueller (Tue Jun 17 2003 - 13:16:33 EDT)
• RE: [Snort-sigs] Traceroute test Blake (Tue Jun 17 2003 - 01:15:45 EDT)
• Re: [Snort-sigs] Traceroute test Brian (Tue Jun 17 2003 - 13:26:23 EDT)
• RE: [Snort-sigs] Duplicate sids in deleted.rules Hugo van der Kooij (Tue Jun 17 2003 - 13:20:03 EDT)
• [Snort-sigs] Traceroute test Esler, Joel Contractor (Tue Jun 17 2003 - 12:28:40 EDT)
• RE: [Snort-sigs] Duplicate sids in deleted.rules L. Christopher Luther (Tue Jun 17 2003 - 11:46:21 EDT)
• Re: [Snort-sigs] Bit Torrent signature Brian (Tue Jun 17 2003 - 09:55:07 EDT)
• Re: [Snort-sigs] Bit Torrent signature Chris Green (Tue Jun 17 2003 - 09:15:08 EDT)
• [Snort-sigs] RE: anyone have more detail other than window size of 55808 to c raft a snort rule for this Smith, Donald (Thu Jun 12 2003 - 16:00:58 EDT)
• [Snort-sigs] Duplicate sids in deleted.rules Martin Olsson (Tue Jun 17 2003 - 03:15:37 EDT)
• [Snort-sigs] Bit Torrent signature Jukka Juslin (Tue Jun 17 2003 - 01:48:05 EDT)
• RE: [Snort-sigs] IANA reserved IP address rules? Schmehl, Paul L (Mon Jun 16 2003 - 17:44:06 EDT)
• Re: [Snort-sigs] IANA reserved IP address rules? Michael Nygren (Mon Jun 16 2003 - 17:29:19 EDT)
• Re: [Snort-sigs] IANA reserved IP address rules? Doug Cress (Mon Jun 16 2003 - 15:47:09 EDT)
• Re: [Snort-sigs] IANA reserved IP address rules? james (Mon Jun 16 2003 - 13:49:12 EDT)
• RE: [Snort-sigs] IANA reserved IP address rules? Hugo van der Kooij (Mon Jun 16 2003 - 13:50:48 EDT)
• RE: [Snort-sigs] IANA reserved IP address rules? Harper, John T. (Mon Jun 16 2003 - 13:20:19 EDT)
• [Snort-sigs] W32/MoFei.worm Esler, Joel Contractor (Mon Jun 16 2003 - 10:00:25 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Sun Jun 15 01:16:51 2003 bmc(at)snort.org (Sun Jun 15 2003 - 01:16:51 EDT)
• [Snort-sigs] snort-rules STABLE update @ Sun Jun 15 01:16:51 2003 bmc(at)snort.org (Sun Jun 15 2003 - 01:16:51 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Sat Jun 14 00:17:06 2003 bmc(at)snort.org (Sat Jun 14 2003 - 00:17:06 EDT)
• [Snort-sigs] snort-rules STABLE update @ Sat Jun 14 00:17:06 2003 bmc(at)snort.org (Sat Jun 14 2003 - 00:17:06 EDT)
• [Snort-sigs] P2P Signature for Edonkey/Emule O'Flynn, Derek (Fri Jun 13 2003 - 16:13:54 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Fri Jun 13 14:26:56 2003 bmc(at)snort.org (Fri Jun 13 2003 - 14:26:56 EDT)
• [Snort-sigs] snort-rules STABLE update @ Fri Jun 13 14:26:56 2003 bmc(at)snort.org (Fri Jun 13 2003 - 14:26:56 EDT)
• RE: [Snort-sigs] A question about Snort Erek Adams (Fri Jun 13 2003 - 08:57:18 EDT)
• RE: [Snort-sigs] A question about Snort Esler, Joel Contractor (Fri Jun 13 2003 - 07:00:33 EDT)
• Re: [Snort-sigs] A question about Snort Erek Adams (Fri Jun 13 2003 - 06:14:43 EDT)
• Re: [Snort-sigs] A question about Snort Matt Kettler (Thu Jun 12 2003 - 16:45:39 EDT)
• [Snort-sigs] RE: anyone have more detail other than window size of 55808 to craft a snort rule for this Coyle, Brian (Thu Jun 12 2003 - 16:28:52 EDT)
• Re: [Snort-sigs] A question about Snort Anthony Kim (Thu Jun 12 2003 - 15:50:15 EDT)
• [Snort-sigs] sigs documentation Chaos (Thu Jun 12 2003 - 15:05:08 EDT)
• Re: [Snort-sigs] anyone have more detail other than window size of 55808 to craft a snort rule for this Jason Falciola (Wed Jun 11 2003 - 19:27:13 EDT)
• RE: [Snort-sigs] A question about Snort adam.w.hogan (Thu Jun 12 2003 - 13:55:42 EDT)
• Re: [Snort-sigs] Window size Bill McCarty (Thu Jun 12 2003 - 12:25:27 EDT)
• [Snort-sigs] PortScan md esa kamsan (Wed Jun 11 2003 - 02:38:41 EDT)
• [Snort-sigs] Re: anyone have more detail other than window size of 55808 to craft a snort rule for this James C. Slora Jr. (Wed Jun 11 2003 - 16:54:22 EDT)
• [Snort-sigs] A question about Snort Maria Teresa Herrera Hueso (Tue Jun 10 2003 - 08:55:21 EDT)
• [Snort-sigs] Re: anyone have more detail other than window size of 55808 to craft a snort rule for this James C. Slora Jr. (Wed Jun 11 2003 - 17:10:07 EDT)
• [Snort-sigs] RE: anyone have more detail other than window size of 55808 to craft a snort rule for this Coyle, Brian (Thu Jun 12 2003 - 13:12:20 EDT)
• RE: [Snort-sigs] More: Question on SID 285 Steven Alexander (Thu Jun 12 2003 - 11:57:23 EDT)
• [Snort-sigs] SID 1103 documentation Kevin Peuhkurinen (Thu Jun 12 2003 - 11:02:09 EDT)
• Re: [Snort-sigs] Window size Brian (Thu Jun 12 2003 - 10:23:11 EDT)
• [Snort-sigs] SID 1050 documentation Kevin Peuhkurinen (Thu Jun 12 2003 - 09:59:24 EDT)
• RE: [Snort-sigs] IANA reserved IP address rules? Joshua Wright (Thu Jun 12 2003 - 07:41:50 EDT)
• Re: [Snort-sigs] IANA reserved IP address rules? Jeff Nathan (Wed Jun 11 2003 - 22:54:47 EDT)
• [Snort-sigs] tcp window size 55808 SYN packets Paul_Drapeau(at)vrtx.com (Wed Jun 11 2003 - 17:05:08 EDT)
• Re: [Snort-sigs] anyone have more detail other than window size of 55808 to craft a snort rule for this Craig Baltes (Wed Jun 11 2003 - 17:08:07 EDT)
• [Snort-sigs] rule documentation for WEB-MISC Oracle XSQLConfig.xml access Josh.Sakofsky(at)donovandata.com (Wed Jun 11 2003 - 17:20:32 EDT)
• [Snort-sigs] rule documentation for FTP SITE NEWER attempt Josh.Sakofsky(at)donovandata.com (Wed Jun 11 2003 - 16:44:16 EDT)
• [Snort-sigs] Window size Bill McCarty (Wed Jun 11 2003 - 16:49:45 EDT)
• [Snort-sigs] IANA reserved IP address rules? Matt Kettler (Wed Jun 11 2003 - 16:47:59 EDT)
• [Snort-sigs] anyone have more detail other than window size of 55808 to craft a snort rule for this Harris, Michael C. (Wed Jun 11 2003 - 16:01:59 EDT)
• [Snort-sigs] rule documentation for WEB-CGI mrtg.cgi directory traversal attempt Josh.Sakofsky(at)donovandata.com (Wed Jun 11 2003 - 15:38:05 EDT)
• [Snort-sigs] SID 1544 documentation Kevin Peuhkurinen (Wed Jun 11 2003 - 15:30:31 EDT)
• [Snort-sigs] SID 1546 documentation Kevin Peuhkurinen (Wed Jun 11 2003 - 14:58:22 EDT)
• [Snort-sigs] rule documentation for WEB-CGI Oracle reports CGI access Josh.Sakofsky(at)donovandata.com (Wed Jun 11 2003 - 14:48:07 EDT)
• [Snort-sigs] rule documentation for ATTACK-RESPONSES successful gobbles ssh exploit (uname) Josh.Sakofsky(at)donovandata.com (Wed Jun 11 2003 - 14:15:54 EDT)
• [Snort-sigs] rule documentation for Josh.Sakofsky(at)donovandata.com (Wed Jun 11 2003 - 13:58:17 EDT)
• [Snort-sigs] SID 1071 documentation Kevin Peuhkurinen (Wed Jun 11 2003 - 12:25:53 EDT)
• [Snort-sigs] SID 1043 documentation Kevin Peuhkurinen (Wed Jun 11 2003 - 12:04:06 EDT)
• [Snort-sigs] rule documentation for WEB-MISC apache ?M=D directory list attempt Josh.Sakofsky(at)donovandata.com (Wed Jun 11 2003 - 11:18:14 EDT)
• [Snort-sigs] Document for Rule 268 DOS Jolt attack U.Siva Kumar (Wed Jun 11 2003 - 03:58:07 EDT)
• [Snort-sigs] More: Question on SID 285 Steven Alexander (Tue Jun 10 2003 - 20:53:50 EDT)
• [Snort-sigs] SID 284 Steven Alexander (Tue Jun 10 2003 - 20:35:16 EDT)
• [Snort-sigs] SID 285 Steven Alexander (Tue Jun 10 2003 - 20:38:13 EDT)
• [Snort-sigs] rule documentation for WEB-MISC carbo.dll access Josh.Sakofsky(at)donovandata.com (Tue Jun 10 2003 - 16:51:18 EDT)
• [Snort-sigs] rule documentation for TELNET SGI telnetd format bug Josh.Sakofsky(at)donovandata.com (Tue Jun 10 2003 - 16:40:15 EDT)
• Re: [Snort-sigs] question regarding web-iis rule NOT triggering.. Matt Kettler (Tue Jun 10 2003 - 15:47:24 EDT)
• RE: [Snort-sigs] Question on SID 285 Steven Alexander (Tue Jun 10 2003 - 15:12:12 EDT)
• [Snort-sigs] Question on SID 285 Steven Alexander (Tue Jun 10 2003 - 14:50:58 EDT)
• [Snort-sigs] question regarding web-iis rule NOT triggering.. Ashley Thomas (Tue Jun 10 2003 - 14:57:11 EDT)
• RE: [Snort-sigs] Signature Definition #460, 5 of 20 and Signature Definition # 458 Jeff Nathan (Tue Jun 10 2003 - 14:45:56 EDT)
• Re: [Snort-sigs] Signature Definition #460, 5 of 20 and Signature Definition # 458 Brian (Tue Jun 10 2003 - 13:55:42 EDT)
• RE: [Snort-sigs] Signature Definition #460, 5 of 20 and Signature Definition # 458 Steven Alexander (Tue Jun 10 2003 - 11:27:03 EDT)
• [Snort-sigs] SID 1156 change recommendation Kevin Peuhkurinen (Tue Jun 10 2003 - 10:11:22 EDT)
• [Snort-sigs] SID 1129 documentation Kevin Peuhkurinen (Tue Jun 10 2003 - 09:21:12 EDT)
• [Snort-sigs] Rule #501 (lssre) dank(at)suburbanjihad.net (Mon Jun 09 2003 - 14:34:18 EDT)
• [Snort-sigs] Documentation (rule #500) dank(at)suburbanjihad.net (Mon Jun 09 2003 - 14:21:44 EDT)
• [Snort-sigs] SID 1808 documentation revised Kevin Peuhkurinen (Tue Jun 10 2003 - 08:21:56 EDT)
• [Snort-sigs] Documentation (#502) dank(at)suburbanjihad.net (Mon Jun 09 2003 - 14:22:56 EDT)
• [Snort-sigs] RE: [Snort-users] SMB login Failure Horta, Benny (Mon Jun 09 2003 - 11:05:11 EDT)
• RE: [Snort-sigs] Signature Definition #462, 6 of 20 Esler, Joel Contractor (Tue Jun 10 2003 - 06:06:48 EDT)
• RE: [Snort-sigs] Signature Definition #460, 5 of 20 and Signature Definition # 458 Esler, Joel Contractor (Tue Jun 10 2003 - 06:05:55 EDT)
• [Snort-sigs] False +ves with sid 1882 with possible fix Russell Fulton (Tue Jun 10 2003 - 04:44:59 EDT)
• RE: [Snort-sigs] Correction to signature 1227 Steven Alexander (Mon Jun 09 2003 - 19:53:44 EDT)
• Re: [Snort-sigs] Correction to signature 1227 Brian (Mon Jun 09 2003 - 19:47:16 EDT)
• RE: [Snort-sigs] SID 716 Steven Alexander (Mon Jun 09 2003 - 19:37:06 EDT)
• [Snort-sigs] Correction to signature 1227 Steven Alexander (Mon Jun 09 2003 - 18:21:45 EDT)
• Re: [Snort-users] Re: [Snort-sigs] Oinkmaster questions Anthony Kim (Mon Jun 09 2003 - 18:24:44 EDT)
• [Snort-sigs] SID 1227 Steven Alexander (Mon Jun 09 2003 - 18:05:14 EDT)
• [Snort-sigs] SID 793 Steven Alexander (Mon Jun 09 2003 - 17:52:25 EDT)
• [Snort-sigs] SID 720 Steven Alexander (Mon Jun 09 2003 - 17:51:51 EDT)
• Re: [Snort-sigs] false +ves for IMAP login overflow (SID 1993) Russell Fulton (Mon Jun 09 2003 - 17:37:16 EDT)
• Re: [Snort-sigs] SID 716 daniel.clemens (Mon Jun 09 2003 - 12:37:59 EDT)
• [Snort-sigs] SID 718 Steven Alexander (Mon Jun 09 2003 - 17:27:19 EDT)
• [Snort-sigs] SID 715 Steven Alexander (Mon Jun 09 2003 - 17:26:03 EDT)
• [Snort-sigs] SID 716 Steven Alexander (Mon Jun 09 2003 - 17:26:20 EDT)
• [Snort-sigs] SID 717 Steven Alexander (Mon Jun 09 2003 - 17:26:42 EDT)
• Re: [Snort-sigs] Oinkmaster questions Russell Fulton (Mon Jun 09 2003 - 17:14:09 EDT)
• [Snort-sigs] RE: [Snort-users] Oinkmaster questions Schmehl, Paul L (Mon Jun 09 2003 - 16:57:51 EDT)
• [Snort-sigs] SID 719 Steven Alexander (Mon Jun 09 2003 - 16:56:07 EDT)
• [Snort-sigs] SID 1828 documentation Kevin Peuhkurinen (Mon Jun 09 2003 - 15:28:02 EDT)
• [Snort-sigs] Documentation (#1325) nicholas black (Mon Jun 09 2003 - 15:16:55 EDT)
• [Snort-sigs] Oinkmaster questions Philip Davidson (Mon Jun 09 2003 - 15:00:02 EDT)
• [Snort-sigs] Sid 456 and 385 documentation change Steven Alexander (Mon Jun 09 2003 - 15:10:18 EDT)
• RE: [Snort-sigs] Signature Definition #460, 5 of 20 and Signature Definition # 458 Steven Alexander (Mon Jun 09 2003 - 14:58:06 EDT)
• RE: [Snort-sigs] Signature Definition #462, 6 of 20 Steven Alexander (Mon Jun 09 2003 - 14:59:55 EDT)
• [Snort-sigs] SID 1852 documentation Kevin Peuhkurinen (Mon Jun 09 2003 - 14:23:30 EDT)
• [Snort-sigs] SID 1857 documentation Kevin Peuhkurinen (Mon Jun 09 2003 - 14:21:15 EDT)
• [Snort-sigs] Signature Definition #1945 , 20 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 13:54:54 EDT)
• [Snort-sigs] some new signatures to consider Kreimendahl, Chad J (Mon Jun 09 2003 - 13:55:06 EDT)
• [Snort-sigs] Signature Definition #1760 , 19 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 13:35:36 EDT)
• [Snort-sigs] RE: Signature Definition #1432 , 18 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 13:30:27 EDT)
• [Snort-sigs] Signature Definition #1227 , 16 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 13:25:54 EDT)
• [Snort-sigs] RE: Signature Definition #1227 , 17 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 13:26:58 EDT)
• [Snort-sigs] Signature Definition #1201, 16 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 13:18:22 EDT)
• [Snort-sigs] SID 482 Steven Alexander (Mon Jun 09 2003 - 13:10:55 EDT)
• [Snort-sigs] SID 467 Steven Alexander (Mon Jun 09 2003 - 13:09:54 EDT)
• [Snort-sigs] SID 484 Steven Alexander (Mon Jun 09 2003 - 13:11:30 EDT)
• [Snort-sigs] SID 481 Steven Alexander (Mon Jun 09 2003 - 13:10:35 EDT)
• [Snort-sigs] SID 483 Steven Alexander (Mon Jun 09 2003 - 13:11:10 EDT)
• [Snort-sigs] SID 466 Steven Alexander (Mon Jun 09 2003 - 13:09:23 EDT)
• [Snort-sigs] SID 465 Steven Alexander (Mon Jun 09 2003 - 13:09:01 EDT)
• [Snort-sigs] SID 476 Steven Alexander (Mon Jun 09 2003 - 13:10:20 EDT)
• [Snort-sigs] SID 382, 17 of 20 Steven Alexander (Mon Jun 09 2003 - 12:48:02 EDT)
• [Snort-sigs] SID 378, 13 of 20 Steven Alexander (Mon Jun 09 2003 - 12:45:49 EDT)
• [Snort-sigs] SID 381, 16 of 20 Steven Alexander (Mon Jun 09 2003 - 12:47:24 EDT)
• [Snort-sigs] SID 379, 14 of 20 Steven Alexander (Mon Jun 09 2003 - 12:46:34 EDT)
• [Snort-sigs] SID 376, 11 of 20 Steven Alexander (Mon Jun 09 2003 - 12:45:00 EDT)
• [Snort-sigs] SID 371 (my contribution #6) Steven Alexander (Mon Jun 09 2003 - 12:39:23 EDT)
• [Snort-sigs] SID 384, 18 of 20 Steven Alexander (Mon Jun 09 2003 - 12:48:36 EDT)
• [Snort-sigs] SID 385, 19 of 20 Steven Alexander (Mon Jun 09 2003 - 12:48:56 EDT)
• [Snort-sigs] SID 380, 15 of 20 Steven Alexander (Mon Jun 09 2003 - 12:47:00 EDT)
• [Snort-sigs] SID 456, 20 of 20 Steven Alexander (Mon Jun 09 2003 - 12:49:24 EDT)
• [Snort-sigs] SID 377, 12 of 20 Steven Alexander (Mon Jun 09 2003 - 12:45:31 EDT)
• [Snort-sigs] Mistake in SID 379 Steven Alexander (Mon Jun 09 2003 - 12:40:52 EDT)
• [Snort-sigs] SID 374, 9 of 20 Steven Alexander (Mon Jun 09 2003 - 12:43:44 EDT)
• [Snort-sigs] SID 373 (my contribution #8) Steven Alexander (Mon Jun 09 2003 - 12:41:34 EDT)
• [Snort-sigs] SID 370 (my contribution #5) Steven Alexander (Mon Jun 09 2003 - 12:38:44 EDT)
• [Snort-sigs] SID 368 (my contribution #3) Steven Alexander (Mon Jun 09 2003 - 12:37:38 EDT)
• [Snort-sigs] SID 375, 10 of 20 Steven Alexander (Mon Jun 09 2003 - 12:44:17 EDT)
• [Snort-sigs] SID 372 (my contribution #7) Steven Alexander (Mon Jun 09 2003 - 12:39:52 EDT)
• [Snort-sigs] SID: 366 (my contribution #2) Steven Alexander (Mon Jun 09 2003 - 12:37:01 EDT)
• [Snort-sigs] SID 369 (my contribution #4) Steven Alexander (Mon Jun 09 2003 - 12:38:04 EDT)
• [Snort-sigs] Signature Definition #1023, 15 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 12:08:20 EDT)
• [Snort-sigs] SID 1809 documentation Kevin Peuhkurinen (Mon Jun 09 2003 - 11:47:51 EDT)
• [Snort-sigs] rule documentation for NETBIOS SMB C$ access Josh.Sakofsky(at)donovandata.com (Mon Jun 09 2003 - 11:45:23 EDT)
• [Snort-sigs] rule documentation for MISC Invalid PCAnywhere Login Josh.Sakofsky(at)donovandata.com (Mon Jun 09 2003 - 11:25:18 EDT)
• [Snort-sigs] Signature Definition #718, 14 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 10:45:19 EDT)
• [Snort-sigs] SID 1808 documentation Kevin Peuhkurinen (Mon Jun 09 2003 - 11:03:38 EDT)
• [Snort-sigs] Signature Definition #719, 13 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 09:52:15 EDT)
• [Snort-sigs] Signature Definition #717, 12 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 09:45:12 EDT)
• [Snort-sigs] doc of rules blacharz(at)femur.pl (Sat Jun 07 2003 - 06:56:17 EDT)
• [Snort-sigs] snort rule documentation (#492) dank(at)suburbanjihad.net (Mon Jun 09 2003 - 09:14:47 EDT)
• Re: [Snort-sigs] SID 1828 change needed Giles Coochey (Sun Jun 08 2003 - 08:37:35 EDT)
• [Snort-sigs] documentation for rule 492 dank(at)suburbanjihad.net (Sun Jun 08 2003 - 19:56:40 EDT)
• [Snort-sigs] snort rule documentation (#522) dank(at)suburbanjihad.net (Mon Jun 09 2003 - 09:15:15 EDT)
• [Snort-sigs] SID 1497 documentation Kevin Peuhkurinen (Mon Jun 09 2003 - 09:37:34 EDT)
• [Snort-sigs] documentation (sid 522) dank(at)suburbanjihad.net (Sun Jun 08 2003 - 20:14:02 EDT)
• [Snort-sigs] Questions and Sig 1313 documentation Gauldin Sean (Sat Jun 07 2003 - 00:03:08 EDT)
• Re: [Snort-sigs] false +ves for IMAP login overflow (SID 1993) Brian (Mon Jun 09 2003 - 09:37:40 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Mon Jun 9 09:28:21 2003 bmc(at)snort.org (Mon Jun 09 2003 - 09:28:21 EDT)
• [Snort-sigs] snort-rules STABLE update @ Mon Jun 9 09:28:21 2003 bmc(at)snort.org (Mon Jun 09 2003 - 09:28:22 EDT)
• [Snort-sigs] Rule Proposal "Kazaa Supernode Event" Esler, Joel Contractor (Mon Jun 09 2003 - 09:09:16 EDT)
• [Snort-sigs] Signature Definition #553, 11 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 09:00:30 EDT)
• [Snort-sigs] Signature Definition #549, 10 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 08:53:16 EDT)
• [Snort-sigs] Signature Definition #556, 9 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 08:41:28 EDT)
• [Snort-sigs] Signature Definition #507, 8 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 08:22:28 EDT)
• [Snort-sigs] Signature Definition #489, 7 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 08:14:55 EDT)
• [Snort-sigs] Signature Definition #359, 3 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 07:59:13 EDT)
• [Snort-sigs] Signature Definition #458, 4 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 08:04:56 EDT)
• [Snort-sigs] Signature Definition #462, 6 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 08:07:21 EDT)
• [Snort-sigs] Signature Definition #460, 5 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 08:06:25 EDT)
• [Snort-sigs] Signature Definition #358, 2 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 07:57:00 EDT)
• [Snort-sigs] Signature Definition #354, 1 of 20 Esler, Joel Contractor (Mon Jun 09 2003 - 07:52:21 EDT)
• [Snort-sigs] false +ves for IMAP login overflow (SID 1993) Russell Fulton (Sun Jun 08 2003 - 23:40:59 EDT)
• Re: RES: [Snort-sigs] W32.Bugbear.B@mm Signature Shane Williams (Sun Jun 08 2003 - 20:10:41 EDT)
• [Snort-sigs] snort-rules STABLE update @ Sun Jun 8 03:34:04 2003 bmc(at)snort.org (Sun Jun 08 2003 - 03:34:05 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Sun Jun 8 03:34:04 2003 bmc(at)snort.org (Sun Jun 08 2003 - 03:34:04 EDT)
• Re: [Snort-sigs] Sig 1313 documentation and questions Brian (Sat Jun 07 2003 - 21:26:30 EDT)
• [Snort-sigs] Sig 1313 documentation and questions Gauldin Sean (Sat Jun 07 2003 - 20:46:15 EDT)
• Re: [Snort-sigs] SID 1042 false positives: WEB-IIS view source via translate header" Brian (Sat Jun 07 2003 - 19:43:47 EDT)
• Re: RES: [Snort-sigs] W32.Bugbear.B@mm Signature daniel.clemens (Fri Jun 06 2003 - 23:27:09 EDT)
• [Snort-sigs] rule documentation for WEB-CLIENT Javascript URL host spoofing attempt Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 16:35:34 EDT)
• RES: [Snort-sigs] W32.Bugbear.B@mm Signature Rodrigo Ramos (Fri Jun 06 2003 - 16:36:13 EDT)
• [Snort-sigs] SID 184 False Posiitives : "WEB-CLIENT Javascript URL host spoofing attemp " SoloNet Newsfeed (Fri Jun 06 2003 - 16:28:49 EDT)
• Re: [Snort-sigs] SID 1882 False Posiitives : "ATTACK-RESPONSES id check returned userid " SoloNet Newsfeed (Fri Jun 06 2003 - 15:36:29 EDT)
• [Snort-sigs] rule documentation for WEB-MISC CISCO VoIP DOS ATTEMPT Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 15:07:18 EDT)
• [Snort-sigs] rule documentation for FTP ADMw0rm ftp login attempt Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 15:04:58 EDT)
• [Snort-sigs] rule documentation for FTP SATAN scan Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 15:05:49 EDT)
• [Snort-sigs] rule documentation for DNS named iquery attempt Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 15:04:36 EDT)
• [Snort-sigs] rule documentation for PORN free XXX Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 15:06:27 EDT)
• [Snort-sigs] rule documentation for WEB-CGI php.cgi access Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 15:06:43 EDT)
• [Snort-sigs] rule documentation for MISC xfs overflow attempt Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 15:07:00 EDT)
• [Snort-sigs] rule documentation for FTP saint scan Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 15:05:31 EDT)
• [Snort-sigs] rule documentation for MISC xdmcp query Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 15:06:04 EDT)
• [Snort-sigs] rule documentation for FTP iss scan Josh.Sakofsky(at)donovandata.com (Fri Jun 06 2003 - 15:05:15 EDT)
• [Snort-sigs] SID 1042 false positives: WEB-IIS view source via translate header" SoloNet Newsfeed (Fri Jun 06 2003 - 14:59:03 EDT)
• [Snort-sigs] SID 1667 documentation Kevin Peuhkurinen (Fri Jun 06 2003 - 11:16:50 EDT)
• Re: [Snort-sigs] SMB Login Failure Brian (Fri Jun 06 2003 - 09:55:06 EDT)
• [Snort-sigs] Snort Rules Contributions Nawapong Nakjang (Thu Jun 05 2003 - 22:21:53 EDT)
• [Snort-sigs] W32.Bugbear.B@mm Signature Tinsley Paul (Fri Jun 06 2003 - 08:58:58 EDT)
• re: [Snort-sigs] Using snort to stop SMTP dictionary attacks david(at)grayskies.net (Fri Jun 06 2003 - 08:32:49 EDT)
• Re: [Snort-sigs] Web service rules Joel Maslak (Thu Jun 05 2003 - 12:49:59 EDT)
• [Snort-sigs] Rule documentation Steven Alexander (Thu Jun 05 2003 - 14:42:58 EDT)
• [Snort-sigs] SMB Login Failure Andy Wood (Thu Jun 05 2003 - 13:24:02 EDT)
• RE: [Snort-sigs] SID 1882 False Posiitives : "ATTACK-RESPONSES i d check returned userid " Erek Adams (Fri Jun 06 2003 - 00:29:06 EDT)
• Re: [Snort-sigs] Using snort to stop SMTP dictionary attacks] Erek Adams (Fri Jun 06 2003 - 00:36:38 EDT)
• [Snort-sigs] SMB login Failure Andy Wood (Thu Jun 05 2003 - 20:21:28 EDT)
• Re: [Snort-sigs] Using snort to stop SMTP dictionary attacks] Dale L. Handy (Thu Jun 05 2003 - 17:10:37 EDT)
• [Snort-sigs] Rule Documentation - teardrop correction Steven Alexander (Thu Jun 05 2003 - 16:28:14 EDT)
• [Snort-sigs] T-shirt! Norbert.Kotras(at)at.flextronics.com (Thu Jun 05 2003 - 07:45:12 EDT)
• [Snort-sigs] Missing attachment Nigel Houghton (Thu Jun 05 2003 - 11:33:49 EDT)
• [Snort-sigs] snort-rules STABLE update @ Thu Jun 5 11:15:37 2003 bmc(at)snort.org (Thu Jun 05 2003 - 11:15:37 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Thu Jun 5 11:15:37 2003 bmc(at)snort.org (Thu Jun 05 2003 - 11:15:37 EDT)
• [Snort-sigs] Sensor Michelle.Moraes(at)stj.gov.br (Mon Jun 02 2003 - 17:21:11 EDT)
• Re: [Snort-sigs] write rule documentation, get a t-shirt Kevin Peuhkurinen (Mon Jun 02 2003 - 11:55:39 EDT)
• Re: [Snort-sigs] write rule documentation, get a t-shirt Giles Coochey (Sun Jun 01 2003 - 19:48:17 EDT)
• [Snort-sigs] Web service rules Joel Maslak (Sun Jun 01 2003 - 22:38:59 EDT)
• [Snort-sigs] WinMX connections and packet capture Jukka Juslin (Thu Jun 05 2003 - 09:35:18 EDT)
• RE: [Snort-sigs] Using snort to stop SMTP dictionary attacks] Rich Adamson  (Thu Jun 05 2003 - 10:18:12 EDT)
• RE: [Snort-sigs] Using snort to stop SMTP dictionary attacks] Esler, Joel Contractor (Thu Jun 05 2003 - 07:40:36 EDT)
• Re: [Snort-sigs] SID 1882 False Posiitives : "ATTACK-RESPONSES id check returned userid " Brian (Wed Jun 04 2003 - 22:00:30 EDT)
• [Snort-sigs] Re: Your application nigel.houghton(at)sourcefire.com (Wed Jun 04 2003 - 20:58:33 EDT)
• Re: [Snort-sigs] Using snort to stop SMTP dictionary attacks] Steve Cody (Wed Jun 04 2003 - 20:20:41 EDT)
• Re: [Snort-sigs] Using snort to stop SMTP dictionary attacks] james (Wed Jun 04 2003 - 19:54:41 EDT)
• Re: [Snort-sigs] Using snort to stop SMTP dictionary attacks] Steve Cody (Wed Jun 04 2003 - 19:16:31 EDT)
• Re: [Snort-sigs] Using snort to stop SMTP dictionary attacks james (Wed Jun 04 2003 - 19:11:25 EDT)
• [Snort-sigs] Using snort to stop SMTP dictionary attacks Steve Cody (Wed Jun 04 2003 - 18:25:10 EDT)
• Re: [Snort-sigs] SID 1882 False Posiitives : "ATTACK-RESPONSES i d check returned userid " SoloNet Newsfeed (Wed Jun 04 2003 - 13:43:59 EDT)
• RE: [Snort-sigs] SID 1882 False Posiitives : "ATTACK-RESPONSES i d check returned userid " Esler, Joel Contractor (Wed Jun 04 2003 - 11:40:28 EDT)
• Re: [Snort-sigs] SID 1882 False Posiitives : "ATTACK-RESPONSES id check returned userid " SoloNet Newsfeed (Wed Jun 04 2003 - 10:53:53 EDT)
• [Snort-sigs] SID 1828 change needed Kevin Peuhkurinen (Mon Jun 02 2003 - 13:46:08 EDT)
• Re: [Snort-sigs] worm_sobig.c? Nigel Houghton (Mon Jun 02 2003 - 09:22:40 EDT)
• [Snort-sigs] worm_sobig.c? Magnus Larsson (Mon Jun 02 2003 - 07:19:02 EDT)
• [Snort-sigs] "MS-SQL ping attempt" is illegal or not? sb ch (Mon Jun 02 2003 - 06:37:11 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Sun Jun 1 21:15:27 2003 bmc(at)snort.org (Sun Jun 01 2003 - 21:15:27 EDT)
• [Snort-sigs] snort-rules STABLE update @ Sun Jun 1 21:15:27 2003 bmc(at)snort.org (Sun Jun 01 2003 - 21:15:27 EDT)
• Re: [Snort-sigs] Proposed change to icmp-info.rules Brian (Sun Jun 01 2003 - 20:52:11 EDT)
• Re: [Snort-sigs] write rule documentation, get a t-shirt Brian (Sun Jun 01 2003 - 19:58:17 EDT)
• [Snort-sigs] write rule documentation, get a t-shirt Brian (Sun Jun 01 2003 - 19:07:20 EDT)
• Re: [Snort-sigs] SMTP rcpt to sed command attempt Tony Lill (Sun Jun 01 2003 - 15:43:40 EDT)