Mailing List Archive For snort-sigs@snort.org Aug 2003 By Date

• Fri Aug 29 2003 - 13:14:07 EDT
  • Re: [Snort-sigs] I don't want scan.log Dan Monjar 
• Thu Aug 28 2003 - 15:16:37 EDT
  • Re: [Snort-sigs] I don't want scan.log Mann E. Schevitz 
• Fri Aug 29 2003 - 11:58:20 EDT
  • Re: [Snort-sigs] Classification.config frenzy(at)frenzy.org 
• Fri Aug 29 2003 - 09:48:32 EDT
  • Re: [Snort-sigs] Quick Nachi ICMP rule -variants? Vincent Vono 
• Fri Aug 29 2003 - 08:50:34 EDT
  • Re: [Snort-sigs] Quick Nachi ICMP rule -variants? Johnathan Norman 
• Fri Aug 29 2003 - 07:06:07 EDT
  • [Snort-sigs] Real Networks vulnerability J-H. Johansen 
• Fri Aug 29 2003 - 02:38:25 EDT
  • Re: [Snort-sigs] syn/fin scans from stream4 Erek Adams 
• Fri Aug 29 2003 - 00:41:36 EDT
  • Re: [Snort-sigs] Quick Nachi ICMP rule -variants? Brian Howard 
• Thu Aug 28 2003 - 21:58:40 EDT
  • Re: [Snort-sigs] Quick Nachi ICMP rule Johnathan Norman 
• Thu Aug 28 2003 - 21:30:37 EDT
  • Re: [Snort-sigs] Quick Nachi ICMP rule Johnathan Norman 
• Thu Aug 28 2003 - 14:49:01 EDT
  • RE: [Snort-sigs] syn/fin scans from stream4 Perry, Brian 
• Thu Aug 28 2003 - 14:05:56 EDT
  • [Snort-sigs] syn/fin scans from stream4 Vincent Vono 
• Thu Aug 28 2003 - 11:33:48 EDT
  • [Snort-sigs] I don't want scan.log Dan Monjar 
• Thu Aug 28 2003 - 06:10:27 EDT
  • [Snort-sigs] MS-SQL Ping false positives David Wilburn 
• Thu Aug 28 2003 - 05:59:57 EDT
  • [Snort-sigs] rule / doc change needed for CyberKit David Wilburn 
• Thu Aug 28 2003 - 03:12:32 EDT
  • Re: [Snort-sigs] Limiting Alert Rates? Newbie Erek Adams 
• Wed Aug 27 2003 - 20:00:52 EDT
  • Re: [Snort-sigs] Limiting Alert Rates? Newbie Tony Lill 
• Wed Aug 27 2003 - 16:42:32 EDT
  • RE: [Snort-sigs] Possible new strain of Blaster or is it a false positive? Compton, Rich 
• Wed Aug 27 2003 - 10:05:17 EDT
  • Re: [Snort-sigs] Limiting Alert Rates? Newbie Richard Crane 
• Wed Aug 27 2003 - 10:09:29 EDT
  • RE: [Snort-sigs] Limiting Alert Rates? Newbie Michael Miller 
• Tue Aug 26 2003 - 10:55:37 EDT
  • [Snort-sigs] Classification.config Williams, Colby E. 
• Tue Aug 26 2003 - 17:50:59 EDT
  • Re: [Snort-sigs] Limiting Alert Rates? Newbie Erek Adams 
• Tue Aug 26 2003 - 15:32:15 EDT
  • [Snort-sigs] Limiting Alert Rates? Newbie Jacob Roberts 
• Mon Aug 25 2003 - 03:33:07 EDT
  • Re: [Snort-sigs] problems setting flags studentmm08.pool-id(at)daimlerchrysler.com 
• Sat Aug 23 2003 - 22:37:28 EDT
  • Re: [Snort-sigs] change to sid 2189 (PIM) to account for MCAST-NET Jon Hart 
• Sat Aug 23 2003 - 21:48:44 EDT
  • [Snort-sigs] change to sid 2189 (PIM) to account for MCAST-NET Jon Hart 
• Fri Aug 22 2003 - 20:50:28 EDT
  • [Snort-sigs] Quick Nachi ICMP rule Paul Schmehl 
• Fri Aug 22 2003 - 19:14:35 EDT
  • [Snort-sigs] Quick Sobig.f rule Paul Schmehl 
• Fri Aug 22 2003 - 16:51:42 EDT
  • Re: [Snort-sigs] Possible new strain of Blaster or is it a false positive? Marty.Bostick(at)protective.com 
• Thu Aug 21 2003 - 10:17:11 EDT
  • Re: [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknownkeyword 'established' in rule! Wes Young 
• Fri Aug 22 2003 - 09:41:28 EDT
  • [Snort-sigs] problems setting flags studentmm08.pool-id(at)daimlerchrysler.com 
• Fri Aug 22 2003 - 16:20:53 EDT
  • [Snort-sigs] Possible new strain of Blaster or is it a false positive? Marty.Bostick(at)protective.com 
• Fri Aug 22 2003 - 12:16:33 EDT
  • [Snort-sigs] rule 1882 broken Bob Tito 
• Fri Aug 22 2003 - 10:29:36 EDT
  • Re: [Snort-sigs] Rule for Sobig.F Hugo van der Kooij 
• Fri Aug 22 2003 - 09:50:58 EDT
  • Re: [Snort-sigs] Rule for Sobig.F Jonathan Norman 
• Wed Aug 20 2003 - 20:33:52 EDT
  • [Snort-sigs] Event log Signature for Slammer John Hally 
• Wed Aug 20 2003 - 08:23:35 EDT
  • RE: [Snort-sigs] Lovegate Signature larosa, vjay 
• Wed Aug 20 2003 - 06:04:37 EDT
  • [Snort-sigs] Lovegate Signature mos def 
• Wed Aug 20 2003 - 00:49:52 EDT
  • Re: [Snort-sigs] Updated BLASTER TFTP rules Brian 
• Wed Aug 20 2003 - 00:27:38 EDT
  • Re: [Snort-sigs] Updated BLASTER TFTP rules Jason Haar 
• Tue Aug 19 2003 - 23:24:36 EDT
  • Re: [Snort-sigs] Updated BLASTER TFTP rules Erick Mechler 
• Tue Aug 19 2003 - 23:39:27 EDT
  • Re: [Snort-sigs] Updated BLASTER TFTP rules Jason Haar 
• Wed Aug 20 2003 - 00:21:31 EDT
  • Re: [Snort-sigs] Updated BLASTER TFTP rules Brian 
• Tue Aug 19 2003 - 19:52:27 EDT
  • [Snort-sigs] Updated BLASTER TFTP rules Jason Haar 
• Tue Aug 19 2003 - 17:30:20 EDT
  • [Snort-sigs] Rule for Sobig.F Shane Williams 
• Tue Aug 19 2003 - 08:56:15 EDT
  • Re: [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknown keyword 'established' in rule! Chris Green 
• Tue Aug 19 2003 - 08:58:01 EDT
  • Re: [Snort-sigs] Snorting without "flow:" Chris Green 
• Tue Aug 19 2003 - 03:00:37 EDT
  • [Snort-sigs] SID 1250 James Affeld 
• Mon Aug 18 2003 - 08:17:24 EDT
  • RE: (long, slightly OT) Re: [Snort-sigs] Blaster Alert-False Nega tive? Bartholomew, Brian J 
• Tue Aug 19 2003 - 02:21:23 EDT
  • RE: [Snort-sigs] problem writing rules for checking traffic and content mad.eye(at)gmx.net 
• Mon Aug 18 2003 - 23:33:38 EDT
  • [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. Colin.Slevin(at)transwareplc.com 
• Mon Aug 18 2003 - 23:23:35 EDT
  • [Snort-sigs] Snorting without "flow:" Sean Batt 
• Mon Aug 18 2003 - 22:00:10 EDT
  • [Snort-sigs] Marek Stiefenhofer ist nicht im Büro m.stiefenhofer(at)ecofis.de 
• Mon Aug 18 2003 - 18:21:41 EDT
  • Re: [Snort-sigs] CYBERKIT [Full-Disclosure] [UPDATE] ping floods Hugo van der Kooij 
• Mon Aug 18 2003 - 16:58:41 EDT
  • RE: [Snort-sigs] problem writing rules for checking traffic and c ontent Eric Baur 
• Mon Aug 18 2003 - 15:15:46 EDT
  • RE: [Snort-sigs] Strange CyberKit alert activity Keith T. Morgan 
• Mon Aug 18 2003 - 14:04:12 EDT
  • RE: [Snort-sigs] Strange CyberKit alert activity Bryan Irvine 
• Mon Aug 18 2003 - 13:44:37 EDT
  • [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. Colin.Slevin(at)transwareplc.com 
• Mon Aug 18 2003 - 13:46:16 EDT
  • [Snort-sigs] CYBERKIT [Full-Disclosure] [UPDATE] ping floods Steve Postma 
• Mon Aug 18 2003 - 13:03:23 EDT
  • RE: [Snort-sigs] Strange CyberKit alert activity Yackley, Matt 
• Mon Aug 18 2003 - 12:56:56 EDT
  • RE: [Snort-sigs] Strange CyberKit alert activity Robert Wagner 
• Mon Aug 18 2003 - 13:26:08 EDT
  • RE: [Snort-sigs] Strange CyberKit alert activity Gavin Lowe 
• Mon Aug 18 2003 - 13:19:51 EDT
  • RE: [Snort-sigs] Strange CyberKit alert activity Pacheco, Michael F. 
• Mon Aug 18 2003 - 13:29:39 EDT
  • RE: [Snort-sigs] Strange CyberKit alert activity Pacheco, Michael F. 
• Mon Aug 18 2003 - 13:04:11 EDT
  • Re: [Snort-sigs] Q about uricontent vs content ; web bot name Dale L. Handy 
• Mon Aug 18 2003 - 12:36:36 EDT
  • [Snort-sigs] Strange CyberKit alert activity David Stubblefield 
• Mon Aug 18 2003 - 09:29:34 EDT
  • [Snort-sigs] Warning: /etc/snort/local.rules(110) => Unknown keyword 'established' in rule! Jukka Juslin 
• Mon Aug 18 2003 - 08:37:53 EDT
  • [Snort-sigs] problem writing rules for checking traffic and content studentmm08.pool-id(at)daimlerchrysler.com 
• Sun Aug 17 2003 - 22:31:41 EDT
  • [Snort-sigs] 1378 sig docs Neal Timm 
• Sun Aug 17 2003 - 23:35:37 EDT
  • [Snort-sigs] Colin Slevin/TRANSWARE/IE is out of the office. Colin.Slevin(at)transwareplc.com 
• Sun Aug 17 2003 - 15:07:22 EDT
  • RE: [Snort-sigs] Blaster Alert-False Negative? Jade E. Deane 
• Sun Aug 17 2003 - 09:30:48 EDT
  • [Snort-sigs] Q about uricontent vs content ; web bot name Michael Scheidell 
• Sat Aug 16 2003 - 04:59:37 EDT
  • [Snort-sigs] Re: Is it possible to Log Headers not Data? Stuart Jenkins 
• Sat Aug 16 2003 - 04:48:31 EDT
  • [Snort-sigs] Is it possible to Log Headers not Data? Stuart Jenkins 
• Thu Aug 14 2003 - 16:53:10 EDT
  • [Snort-sigs] GPL/Open Source: Naieve Question Vkmobile 
• Fri Aug 15 2003 - 18:41:58 EDT
  • Re: [Snort-sigs] snorting telnet caffeinex36(at)yahoo.com 
• Fri Aug 15 2003 - 18:04:29 EDT
  • [Snort-sigs] snorting telnet Bryan Irvine 
• Thu Aug 14 2003 - 18:32:32 EDT
  • Re: [Snort-sigs] GPL/Open Source: Naieve Question James Riden 
• Thu Aug 14 2003 - 19:58:15 EDT
  • Re: [Snort-sigs] Possible new trojan Matt Kettler 
• Thu Aug 14 2003 - 10:13:26 EDT
  • [Snort-sigs] Blaster/Lovosan Rules Gregor Domhan 
• Fri Aug 15 2003 - 16:56:53 EDT
  • (long, slightly OT) Re: [Snort-sigs] Blaster Alert-False Negative? JP Vossen 
• Fri Aug 15 2003 - 16:18:12 EDT
  • [Snort-sigs] Web Traffic Logging Travis Rodak 
• Fri Aug 15 2003 - 15:43:06 EDT
  • [Snort-sigs] tftp msblast.exe rule Kaufman, Adam 
• Thu Aug 14 2003 - 12:42:15 EDT
  • RE: [Snort-sigs] Blaster Alert-False Negative? lordchariot(at)earthlink.net 
• Thu Aug 14 2003 - 11:22:29 EDT
  • Re: [Snort-sigs] Blaster Alert-False Negative? Michael Scheidell 
• Thu Aug 14 2003 - 11:41:24 EDT
  • RE: [Snort-sigs] Can someone please repost a sig for MS Blaster? Parker, Ian 
• Thu Aug 14 2003 - 10:34:50 EDT
  • Re: [Snort-sigs] Blaster Alert-False Negative? James Riden 
• Wed Aug 13 2003 - 11:10:21 EDT
  • [Snort-sigs] Blaster Alert-False Negative? Bartholomew, Brian J 
• Wed Aug 13 2003 - 18:39:48 EDT
  • Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? Nigel Houghton 
• Wed Aug 13 2003 - 17:53:24 EDT
  • Re: [Snort-sigs] Sig file for W32.Blaster.Worm? Erick Mechler 
• Wed Aug 13 2003 - 16:25:46 EDT
  • [Snort-sigs] Sig file for W32.Blaster.Worm? Jason Antonacci 
• Wed Aug 13 2003 - 15:47:08 EDT
  • Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? Joe Stewart 
• Wed Aug 13 2003 - 15:26:57 EDT
  • Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? Erick Mechler 
• Wed Aug 13 2003 - 15:03:26 EDT
  • Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? Marty.Bostick(at)protective.com 
• Wed Aug 13 2003 - 10:02:39 EDT
  • Re: [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? daniel uriah clemens 
• Wed Aug 13 2003 - 14:37:19 EDT
  • Re: [Snort-sigs] Can someone please repost a sig for MS Blaster? Alex Burger 
• Wed Aug 13 2003 - 13:48:32 EDT
  • [Snort-sigs] Can someone please repost a sig for MS Blaster? Eric Joe 
• Wed Aug 13 2003 - 14:15:50 EDT
  • [Snort-sigs] Any new signatures for the other Variants of the Blaster Worm? Marty.Bostick(at)protective.com 
• Wed Aug 13 2003 - 08:48:25 EDT
  • RE: [Snort-sigs] fault positives Joshua Wright 
• Wed Aug 13 2003 - 08:54:15 EDT
  • Re: [Snort-sigs] Re: Snort sign for Microsoft DCOM RPC Worm Alert Jason 
• Wed Aug 13 2003 - 05:21:15 EDT
  • [Snort-sigs] fault positives studentmm08.pool-id(at)daimlerchrysler.com 
• Tue Aug 12 2003 - 21:12:20 EDT
  • RE: FW: [Snort-sigs] DCom RPC attack response sig Sewell, Michael K 
• Wed Aug 13 2003 - 08:10:17 EDT
  • [Snort-sigs] fault positives studentmm08.pool-id(at)daimlerchrysler.com 
• Wed Aug 13 2003 - 03:31:43 EDT
  • Re: FW: [Snort-sigs] DCom RPC attack response sig Chris Kronberg 
• Tue Aug 12 2003 - 14:54:07 EDT
  • Re: FW: [Snort-sigs] DCom RPC attack response sig Bennett Todd 
• Tue Aug 12 2003 - 14:36:39 EDT
  • RE: FW: [Snort-sigs] DCom RPC attack response sig Chris Kronberg 
• Tue Aug 12 2003 - 13:18:58 EDT
  • RE: FW: [Snort-sigs] DCom RPC attack response sig Tech 
• Tue Aug 12 2003 - 07:17:32 EDT
  • [Snort-sigs] Re: Snort sign for Microsoft DCOM RPC Worm Alert IntegPatchMgr 
• Tue Aug 12 2003 - 01:56:29 EDT
  • Re: FW: [Snort-sigs] DCom RPC attack response sig Pogue 
• Mon Aug 11 2003 - 12:09:54 EDT
  • [Snort-sigs] src or dst port alejandro corletti 
• Tue Aug 12 2003 - 10:18:13 EDT
  • [Snort-sigs] Blaster Worm Signature?? DasPadre(at)aol.com 
• Tue Aug 12 2003 - 02:13:25 EDT
  • [Snort-sigs] RE: Snort-sigs digest, Vol 1 #670 - 1 msg Vuppala, Vijaybhasker (EM, GECIS) 
• Thu Aug 07 2003 - 22:39:10 EDT
  • Re: [Snort-sigs] DCom RPC attack response sig CK Ng 
• Sat Aug 09 2003 - 00:54:27 EDT
  • Re: [Snort-sigs] Signature Timestamp? JP Vossen 
• Fri Aug 08 2003 - 09:19:12 EDT
  • Re: [Snort-sigs] Signature Timestamp? Dusty Hall 
• Thu Aug 07 2003 - 23:43:05 EDT
  • [Snort-sigs] RE: Snort-sigs digest, Vol 1 #667 - 4 msgs SG-Chew Poh Chang 
• Thu Aug 07 2003 - 17:21:27 EDT
  • Re: [Snort-sigs] Signature Timestamp? Matt Kettler 
• Thu Aug 07 2003 - 10:08:49 EDT
  • [Snort-sigs] Signature Timestamp? Dusty Hall 
• Thu Aug 07 2003 - 09:30:54 EDT
  • [Snort-sigs] AIM Express sigs Alan Kloster 
• Wed Aug 06 2003 - 21:42:49 EDT
  • Re: [Snort-sigs] Snort rules am attaching the files Nigel Houghton 
• Wed Aug 06 2003 - 16:58:37 EDT
  • [Snort-sigs] Documentation: sid 1791 Steven Alexander 
• Wed Aug 06 2003 - 16:40:43 EDT
  • Re: [Snort-sigs] Snort rules am attaching the files Erek Adams 
• Wed Aug 06 2003 - 12:21:33 EDT
  • [Snort-sigs] Compaq Insight Management Agent Rich Adamson  
• Wed Aug 06 2003 - 10:06:18 EDT
  • [Snort-sigs] Snort Sigs Documents Neal Timm 
• Wed Aug 06 2003 - 06:24:16 EDT
  • Re: [Snort-sigs] RESERVED IP and Broadcast address Michael Scheidell 
• Wed Aug 06 2003 - 05:04:29 EDT
  • [Snort-sigs] RESERVED IP and Broadcast address Peter Millington 
• Tue Aug 05 2003 - 19:41:40 EDT
  • RE: [Snort-sigs] DCom RPC attack response sig Michael Anuzis 
• Wed Aug 06 2003 - 02:53:29 EDT
  • [Snort-sigs] [Fwd: Re: [Dragonidsuser] W32/Mimail Signature] Burak DAYIOGLU 
• Fri Aug 01 2003 - 04:24:25 EDT
  • [Snort-sigs] Rule Update Altrock, Jens 
• Sat Aug 02 2003 - 02:01:49 EDT
  • [Snort-sigs] Sig for Grim's Ping FTP scanner tool JP Vossen 
• Fri Aug 01 2003 - 14:38:25 EDT
  • [Snort-sigs] More DCOM sigs JP Vossen 
• Fri Aug 01 2003 - 09:43:10 EDT
  • [Snort-sigs] Robin Smits/NL/GTS/PwC is out of the office. robin.smits(at)nl.pwc.com 

  This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:09:16 EDT