Mailing List Archive For snort-sigs@snort.org Aug 2003 By Author

• Alan Kloster
  • [Snort-sigs] AIM Express sigs (Thu Aug 07 2003 - 09:30:54 EDT)
• alejandro corletti
  • [Snort-sigs] src or dst port (Mon Aug 11 2003 - 12:09:54 EDT)
• Alex Burger
  • Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? (Wed Aug 13 2003 - 14:37:19 EDT)
• Altrock, Jens
  • [Snort-sigs] Rule Update (Fri Aug 01 2003 - 04:24:25 EDT)
• Bartholomew, Brian J
  • RE: (long, slightly OT) Re: [Snort-sigs] Blaster Alert-False Nega tive? (Mon Aug 18 2003 - 08:17:24 EDT)
  • [Snort-sigs] Blaster Alert-False Negative? (Wed Aug 13 2003 - 11:10:21 EDT)
• Bennett Todd
  • Re: FW: [Snort-sigs] DCom RPC attack response sig (Tue Aug 12 2003 - 14:54:07 EDT)
• Bob Tito
  • [Snort-sigs] rule 1882 broken (Fri Aug 22 2003 - 12:16:33 EDT)
• Brian
  • Re: [Snort-sigs] Updated BLASTER TFTP rules (Wed Aug 20 2003 - 00:49:52 EDT)
  • Re: [Snort-sigs] Updated BLASTER TFTP rules (Wed Aug 20 2003 - 00:21:31 EDT)
• Brian Howard
  • Re: [Snort-sigs] Quick Nachi ICMP rule -variants? (Fri Aug 29 2003 - 00:41:36 EDT)
• Bryan Irvine
  • RE: [Snort-sigs] Strange CyberKit alert activity (Mon Aug 18 2003 - 14:04:12 EDT)
  • [Snort-sigs] snorting telnet (Fri Aug 15 2003 - 18:04:29 EDT)
• Burak DAYIOGLU
  • [Snort-sigs] [Fwd: Re: [Dragonidsuser] W32/Mimail Signature] (Wed Aug 06 2003 - 02:53:29 EDT)
• caffeinex36(at)yahoo.com
  • Re: [Snort-sigs] snorting telnet (Fri Aug 15 2003 - 18:41:58 EDT)
• Chris Green
  • Re: [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknown keyword 'established' in rule! (Tue Aug 19 2003 - 08:56:15 EDT)
  • Re: [Snort-sigs] Snorting without "flow:" (Tue Aug 19 2003 - 08:58:01 EDT)
• Chris Kronberg
  • Re: FW: [Snort-sigs] DCom RPC attack response sig (Wed Aug 13 2003 - 03:31:43 EDT)
  • RE: FW: [Snort-sigs] DCom RPC attack response sig (Tue Aug 12 2003 - 14:36:39 EDT)
• CK Ng
  • Re: [Snort-sigs] DCom RPC attack response sig (Thu Aug 07 2003 - 22:39:10 EDT)
• Colin.Slevin(at)transwareplc.com
  • [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. (Mon Aug 18 2003 - 23:33:38 EDT)
  • [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. (Mon Aug 18 2003 - 13:44:37 EDT)
  • [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. (Sun Aug 17 2003 - 23:35:37 EDT)
• Compton, Rich
  • RE: [Snort-sigs] Possible new strain of Blaster or is it a false positive? (Wed Aug 27 2003 - 16:42:32 EDT)
• Dale L. Handy
  • Re: [Snort-sigs] Q about uricontent vs content ; web bot name (Mon Aug 18 2003 - 13:04:11 EDT)
• Dan Monjar
  • Re: [Snort-sigs] I don't want scan.log (Fri Aug 29 2003 - 13:14:07 EDT)
  • [Snort-sigs] I don't want scan.log (Thu Aug 28 2003 - 11:33:48 EDT)
• daniel uriah clemens
  • Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? (Wed Aug 13 2003 - 10:02:39 EDT)
• DasPadre(at)aol.com
  • [Snort-sigs] Blaster Worm Signature?? (Tue Aug 12 2003 - 10:18:13 EDT)
• David Stubblefield
  • [Snort-sigs] Strange CyberKit alert activity (Mon Aug 18 2003 - 12:36:36 EDT)
• David Wilburn
  • [Snort-sigs] MS-SQL Ping false positives (Thu Aug 28 2003 - 06:10:27 EDT)
  • [Snort-sigs] rule / doc change needed for CyberKit (Thu Aug 28 2003 - 05:59:57 EDT)
• Dusty Hall
  • Re: [Snort-sigs] Signature Timestamp? (Fri Aug 08 2003 - 09:19:12 EDT)
  • [Snort-sigs] Signature Timestamp? (Thu Aug 07 2003 - 10:08:49 EDT)
• Erek Adams
  • Re: [Snort-sigs] syn/fin scans from stream4 (Fri Aug 29 2003 - 02:38:25 EDT)
  • Re: [Snort-sigs] Limiting Alert Rates? Newbie (Thu Aug 28 2003 - 03:12:32 EDT)
  • Re: [Snort-sigs] Limiting Alert Rates? Newbie (Tue Aug 26 2003 - 17:50:59 EDT)
  • Re: [Snort-sigs] Snort rules am attaching the files (Wed Aug 06 2003 - 16:40:43 EDT)
• Eric Baur
  • RE: [Snort-sigs] problem writing rules for checking traffic and c ontent (Mon Aug 18 2003 - 16:58:41 EDT)
• Eric Joe
  • [Snort-sigs] Can someone please repost a sig for MS Blaster? (Wed Aug 13 2003 - 13:48:32 EDT)
• Erick Mechler
  • Re: [Snort-sigs] Updated BLASTER TFTP rules (Tue Aug 19 2003 - 23:24:36 EDT)
  • Re: [Snort-sigs] Sig file for W32.Blaster.Worm? (Wed Aug 13 2003 - 17:53:24 EDT)
  • Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? (Wed Aug 13 2003 - 15:26:57 EDT)
• frenzy(at)frenzy.org
  • Re: [Snort-sigs] Classification.config (Fri Aug 29 2003 - 11:58:20 EDT)
• Gavin Lowe
  • RE: [Snort-sigs] Strange CyberKit alert activity (Mon Aug 18 2003 - 13:26:08 EDT)
• Gregor Domhan
  • [Snort-sigs] Blaster/Lovosan Rules (Thu Aug 14 2003 - 10:13:26 EDT)
• Hugo van der Kooij
  • Re: [Snort-sigs] Rule for Sobig.F (Fri Aug 22 2003 - 10:29:36 EDT)
  • Re: [Snort-sigs] CYBERKIT [Full-Disclosure] [UPDATE] ping floods (Mon Aug 18 2003 - 18:21:41 EDT)
• IntegPatchMgr
  • [Snort-sigs] Re: Snort sign for Microsoft DCOM RPC Worm Alert (Tue Aug 12 2003 - 07:17:32 EDT)
• J-H. Johansen
  • [Snort-sigs] Real Networks vulnerability (Fri Aug 29 2003 - 07:06:07 EDT)
• Jacob Roberts
  • [Snort-sigs] Limiting Alert Rates? Newbie (Tue Aug 26 2003 - 15:32:15 EDT)
• Jade E. Deane
  • RE: [Snort-sigs] Blaster Alert-False Negative? (Sun Aug 17 2003 - 15:07:22 EDT)
• James Affeld
  • [Snort-sigs] SID 1250 (Tue Aug 19 2003 - 03:00:37 EDT)
• James Riden
  • Re: [Snort-sigs] GPL/Open Source: Naieve Question (Thu Aug 14 2003 - 18:32:32 EDT)
  • Re: [Snort-sigs] Blaster Alert-False Negative? (Thu Aug 14 2003 - 10:34:50 EDT)
• Jason
  • Re: [Snort-sigs] Re: Snort sign for Microsoft DCOM RPC Worm Alert (Wed Aug 13 2003 - 08:54:15 EDT)
• Jason Antonacci
  • [Snort-sigs] Sig file for W32.Blaster.Worm? (Wed Aug 13 2003 - 16:25:46 EDT)
• Jason Haar
  • Re: [Snort-sigs] Updated BLASTER TFTP rules (Wed Aug 20 2003 - 00:27:38 EDT)
  • Re: [Snort-sigs] Updated BLASTER TFTP rules (Tue Aug 19 2003 - 23:39:27 EDT)
  • [Snort-sigs] Updated BLASTER TFTP rules (Tue Aug 19 2003 - 19:52:27 EDT)
• Joe Stewart
  • Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? (Wed Aug 13 2003 - 15:47:08 EDT)
• John Hally
  • [Snort-sigs] Event log Signature for Slammer (Wed Aug 20 2003 - 20:33:52 EDT)
• Johnathan Norman
  • Re: [Snort-sigs] Quick Nachi ICMP rule -variants? (Fri Aug 29 2003 - 08:50:34 EDT)
  • Re: [Snort-sigs] Quick Nachi ICMP rule (Thu Aug 28 2003 - 21:58:40 EDT)
  • Re: [Snort-sigs] Quick Nachi ICMP rule (Thu Aug 28 2003 - 21:30:37 EDT)
• Jon Hart
  • Re: [Snort-sigs] change to sid 2189 (PIM) to account for MCAST-NET (Sat Aug 23 2003 - 22:37:28 EDT)
  • [Snort-sigs] change to sid 2189 (PIM) to account for MCAST-NET (Sat Aug 23 2003 - 21:48:44 EDT)
• Jonathan Norman
  • Re: [Snort-sigs] Rule for Sobig.F (Fri Aug 22 2003 - 09:50:58 EDT)
• Joshua Wright
  • RE: [Snort-sigs] fault positives (Wed Aug 13 2003 - 08:48:25 EDT)
• JP Vossen
  • (long, slightly OT) Re: [Snort-sigs] Blaster Alert-False Negative? (Fri Aug 15 2003 - 16:56:53 EDT)
  • Re: [Snort-sigs] Signature Timestamp? (Sat Aug 09 2003 - 00:54:27 EDT)
  • [Snort-sigs] Sig for Grim's Ping FTP scanner tool (Sat Aug 02 2003 - 02:01:49 EDT)
  • [Snort-sigs] More DCOM sigs (Fri Aug 01 2003 - 14:38:25 EDT)
• Jukka Juslin
  • [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknown keyword 'established' in rule! (Mon Aug 18 2003 - 09:29:34 EDT)
• Kaufman, Adam
  • [Snort-sigs] tftp msblast.exe rule (Fri Aug 15 2003 - 15:43:06 EDT)
• Keith T. Morgan
  • RE: [Snort-sigs] Strange CyberKit alert activity (Mon Aug 18 2003 - 15:15:46 EDT)
• larosa, vjay
  • RE: [Snort-sigs] Lovegate Signature (Wed Aug 20 2003 - 08:23:35 EDT)
• lordchariot(at)earthlink.net
  • RE: [Snort-sigs] Blaster Alert-False Negative? (Thu Aug 14 2003 - 12:42:15 EDT)
• m.stiefenhofer(at)ecofis.de
  • [Snort-sigs] Marek Stiefenhofer ist nicht im Büro (Mon Aug 18 2003 - 22:00:10 EDT)
• mad.eye(at)gmx.net
  • RE: [Snort-sigs] problem writing rules for checking traffic and content (Tue Aug 19 2003 - 02:21:23 EDT)
• Mann E. Schevitz
  • Re: [Snort-sigs] I don't want scan.log (Thu Aug 28 2003 - 15:16:37 EDT)
• Marty.Bostick(at)protective.com
  • Re: [Snort-sigs] Possible new strain of Blaster or is it a false positive? (Fri Aug 22 2003 - 16:51:42 EDT)
  • [Snort-sigs] Possible new strain of Blaster or is it a false positive? (Fri Aug 22 2003 - 16:20:53 EDT)
  • Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? (Wed Aug 13 2003 - 15:03:26 EDT)
  • [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? (Wed Aug 13 2003 - 14:15:50 EDT)
• Matt Kettler
  • Re: [Snort-sigs] Possible new trojan (Thu Aug 14 2003 - 19:58:15 EDT)
  • Re: [Snort-sigs] Signature Timestamp? (Thu Aug 07 2003 - 17:21:27 EDT)
• Michael Anuzis
  • RE: [Snort-sigs] DCom RPC attack response sig (Tue Aug 05 2003 - 19:41:40 EDT)
• Michael Miller
  • RE: [Snort-sigs] Limiting Alert Rates? Newbie (Wed Aug 27 2003 - 10:09:29 EDT)
• Michael Scheidell
  • [Snort-sigs] Q about uricontent vs content ; web bot name (Sun Aug 17 2003 - 09:30:48 EDT)
  • Re: [Snort-sigs] Blaster Alert-False Negative? (Thu Aug 14 2003 - 11:22:29 EDT)
  • Re: [Snort-sigs] RESERVED IP and Broadcast address (Wed Aug 06 2003 - 06:24:16 EDT)
• mos def
  • [Snort-sigs] Lovegate Signature (Wed Aug 20 2003 - 06:04:37 EDT)
• Neal Timm
  • [Snort-sigs] 1378 sig docs (Sun Aug 17 2003 - 22:31:41 EDT)
  • [Snort-sigs] Snort Sigs Documents (Wed Aug 06 2003 - 10:06:18 EDT)
• Nigel Houghton
  • Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? (Wed Aug 13 2003 - 18:39:48 EDT)
  • Re: [Snort-sigs] Snort rules am attaching the files (Wed Aug 06 2003 - 21:42:49 EDT)
• Pacheco, Michael F.
  • RE: [Snort-sigs] Strange CyberKit alert activity (Mon Aug 18 2003 - 13:19:51 EDT)
  • RE: [Snort-sigs] Strange CyberKit alert activity (Mon Aug 18 2003 - 13:29:39 EDT)
• Parker, Ian
  • RE: [Snort-sigs] Can someone please repost a sig for MS Blaster? (Thu Aug 14 2003 - 11:41:24 EDT)
• Paul Schmehl
  • [Snort-sigs] Quick Nachi ICMP rule (Fri Aug 22 2003 - 20:50:28 EDT)
  • [Snort-sigs] Quick Sobig.f rule (Fri Aug 22 2003 - 19:14:35 EDT)
• Perry, Brian
  • RE: [Snort-sigs] syn/fin scans from stream4 (Thu Aug 28 2003 - 14:49:01 EDT)
• Peter Millington
  • [Snort-sigs] RESERVED IP and Broadcast address (Wed Aug 06 2003 - 05:04:29 EDT)
• Pogue
  • Re: FW: [Snort-sigs] DCom RPC attack response sig (Tue Aug 12 2003 - 01:56:29 EDT)
• Rich Adamson
  • [Snort-sigs] Compaq Insight Management Agent (Wed Aug 06 2003 - 12:21:33 EDT)
• Richard Crane
  • Re: [Snort-sigs] Limiting Alert Rates? Newbie (Wed Aug 27 2003 - 10:05:17 EDT)
• Robert Wagner
  • RE: [Snort-sigs] Strange CyberKit alert activity (Mon Aug 18 2003 - 12:56:56 EDT)
• robin.smits(at)nl.pwc.com
  • [Snort-sigs] Robin Smits/NL/GTS/PwC is out of the office. (Fri Aug 01 2003 - 09:43:10 EDT)
• Sean Batt
  • [Snort-sigs] Snorting without "flow:" (Mon Aug 18 2003 - 23:23:35 EDT)
• Sewell, Michael K
  • RE: FW: [Snort-sigs] DCom RPC attack response sig (Tue Aug 12 2003 - 21:12:20 EDT)
• SG-Chew Poh Chang
  • [Snort-sigs] RE: Snort-sigs digest, Vol 1 #667 - 4 msgs (Thu Aug 07 2003 - 23:43:05 EDT)
• Shane Williams
  • [Snort-sigs] Rule for Sobig.F (Tue Aug 19 2003 - 17:30:20 EDT)
• Steve Postma
  • [Snort-sigs] CYBERKIT [Full-Disclosure] [UPDATE] ping floods (Mon Aug 18 2003 - 13:46:16 EDT)
• Steven Alexander
  • [Snort-sigs] Documentation: sid 1791 (Wed Aug 06 2003 - 16:58:37 EDT)
• Stuart Jenkins
  • [Snort-sigs] Re: Is it possible to Log Headers not Data? (Sat Aug 16 2003 - 04:59:37 EDT)
  • [Snort-sigs] Is it possible to Log Headers not Data? (Sat Aug 16 2003 - 04:48:31 EDT)
• studentmm08.pool-id(at)daimlerchrysler.com
  • Re: [Snort-sigs] problems setting flags (Mon Aug 25 2003 - 03:33:07 EDT)
  • [Snort-sigs] problems setting flags (Fri Aug 22 2003 - 09:41:28 EDT)
  • [Snort-sigs] problem writing rules for checking traffic and content (Mon Aug 18 2003 - 08:37:53 EDT)
  • [Snort-sigs] fault positives (Wed Aug 13 2003 - 05:21:15 EDT)
  • [Snort-sigs] fault positives (Wed Aug 13 2003 - 08:10:17 EDT)
• Tech
  • RE: FW: [Snort-sigs] DCom RPC attack response sig (Tue Aug 12 2003 - 13:18:58 EDT)
• Tony Lill
  • Re: [Snort-sigs] Limiting Alert Rates? Newbie (Wed Aug 27 2003 - 20:00:52 EDT)
• Travis Rodak
  • [Snort-sigs] Web Traffic Logging (Fri Aug 15 2003 - 16:18:12 EDT)
• Vincent Vono
  • Re: [Snort-sigs] Quick Nachi ICMP rule -variants? (Fri Aug 29 2003 - 09:48:32 EDT)
  • [Snort-sigs] syn/fin scans from stream4 (Thu Aug 28 2003 - 14:05:56 EDT)
• Vkmobile
  • [Snort-sigs] GPL/Open Source: Naieve Question (Thu Aug 14 2003 - 16:53:10 EDT)
• Vuppala, Vijaybhasker (EM, GECIS)
  • [Snort-sigs] RE: Snort-sigs digest, Vol 1 #670 - 1 msg (Tue Aug 12 2003 - 02:13:25 EDT)
• Wes Young
  • Re: [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknownkeyword 'established' in rule! (Thu Aug 21 2003 - 10:17:11 EDT)
• Williams, Colby E.
  • [Snort-sigs] Classification.config (Tue Aug 26 2003 - 10:55:37 EDT)
• Yackley, Matt
  • RE: [Snort-sigs] Strange CyberKit alert activity (Mon Aug 18 2003 - 13:03:23 EDT)

  This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:09:16 EDT