Mailing List Archive For snort-sigs@snort.org Sep 2003 By Thread

• Re: [Snort-sigs] Using snort to Identify P2P transfers. dmitriy.dunavetsky(at)clorox.com (Tue Sep 30 2003 - 11:58:33 EDT)
• [Snort-sigs] Re: sig for recent massive ICMP scans Nick.Cross(at)uk.consulting.fujitsu.com (Tue Sep 30 2003 - 06:02:36 EDT)
• Re: [Snort-sigs] False positives WEB-CGI calendar access Daniel de Young (Tue Sep 30 2003 - 04:16:57 EDT)
• Re: [Snort-sigs] False positives WEB-CGI calendar access Johnathan Norman (Tue Sep 30 2003 - 02:46:49 EDT)
• Re: [Snort-sigs] Using snort to Identify P2P transfers. james (Tue Sep 30 2003 - 01:34:36 EDT)
• RE: [Snort-sigs] False Positive on sid 10000009 Nick Duda (Mon Sep 29 2003 - 17:43:22 EDT)
• Re: [Snort-sigs] False Positive on sid 10000009 Joe Stewart (Mon Sep 29 2003 - 17:30:17 EDT)
• [Snort-sigs] False Positive on sid 10000009 Adam Towarnyckyj (Fri Sep 26 2003 - 12:59:40 EDT)
• [Snort-sigs] Using snort to Identify P2P transfers. Tony Hernandez (Mon Sep 29 2003 - 11:51:12 EDT)
• [Snort-sigs] Scott Myers is out of the office. Scott Myers (Mon Sep 29 2003 - 10:01:38 EDT)
• Re: [Snort-sigs] False positives WEB-CGI calendar access Daniel de Young (Mon Sep 29 2003 - 04:54:01 EDT)
• [Snort-sigs] False positives WEB-CGI calendar access Hugo van der Kooij (Mon Sep 29 2003 - 01:11:03 EDT)
• Re: [Snort-sigs] sig for recent massive ICMP scans SoloNet Newsfeed (Fri Sep 26 2003 - 09:25:23 EDT)
• RE: [Snort-sigs] NETBIOS DCERPC ISystemActivator bind attempt d'Ambly, Jeff (Fri Sep 26 2003 - 09:01:11 EDT)
• Re: [Snort-sigs] sig for recent massive ICMP scans Bill Terwilliger (Thu Sep 25 2003 - 23:44:48 EDT)
• [Snort-sigs] RE: {Snort-sigs] sig for recent massive ICMP's Richard Ullrich (Thu Sep 25 2003 - 17:11:42 EDT)
• Re: [Snort-sigs] W32/SWEN.A signature Jordi Herrero (Fri Sep 26 2003 - 05:43:05 EDT)
• [Snort-sigs] CJ Schmit is out of the office. CJ.Schmit(at)kohls.com (Fri Sep 26 2003 - 05:00:46 EDT)
• Re: [Snort-sigs] sig for recent massive ICMP scans Brian Howard (Fri Sep 26 2003 - 00:00:57 EDT)
• Re: [Snort-sigs] sig for recent massive ICMP scans Paul Schmehl (Thu Sep 25 2003 - 23:08:17 EDT)
• RE: [Snort-sigs] NETBIOS DCERPC ISystemActivator bind attempt Robert Reid (Thu Sep 25 2003 - 20:59:04 EDT)
• [Snort-sigs] sig for recent massive ICMP scans SoloNet Newsfeed (Thu Sep 25 2003 - 16:43:37 EDT)
• Re: [Snort-sigs] NETBIOS DCERPC ISystemActivator bind attempt Ian Boje (Thu Sep 25 2003 - 16:11:36 EDT)
• Re: [Snort-sigs] NETBIOS DCERPC ISystemActivator bind attempt Sir Fenix (Thu Sep 25 2003 - 13:12:41 EDT)
• [Snort-sigs] NETBIOS DCERPC ISystemActivator bind attempt d'Ambly, Jeff (Thu Sep 25 2003 - 11:29:25 EDT)
• [Snort-sigs] ProFTPD vulnerability signature development Joe Stewart (Wed Sep 24 2003 - 15:18:03 EDT)
• Re: [Snort-sigs] sig question Matt Kettler (Wed Sep 24 2003 - 13:30:21 EDT)
• [Snort-sigs] sig question Nick Duda (Wed Sep 24 2003 - 11:37:21 EDT)
• Re: [Snort-sigs] Question about submitting additions to existing rule docs Nigel Houghton (Wed Sep 24 2003 - 09:50:35 EDT)
• [Snort-sigs] Question about submitting additions to existing rule docs Yackley, Matt (Wed Sep 24 2003 - 09:36:42 EDT)
• Re: [Snort-sigs] SID 113 Nigel Houghton (Wed Sep 24 2003 - 08:56:58 EDT)
• [Snort-sigs] SID 113 Muhammad Faisal Rauf Danka (Wed Sep 24 2003 - 03:07:54 EDT)
• RE: [Snort-sigs] Sig for Worm Swen.a? Robert Wagner (Tue Sep 23 2003 - 09:42:35 EDT)
• RE: [Snort-sigs] exclude IP from a rule Nick Duda (Tue Sep 23 2003 - 08:38:00 EDT)
• RE: [Snort-sigs] exclude IP from a rule Esler, Joel Contractor (Tue Sep 23 2003 - 08:32:57 EDT)
• [Snort-sigs] Kazaa sig Nick Duda (Tue Sep 23 2003 - 07:47:13 EDT)
• [Snort-sigs] exclude IP from a rule Nick Duda (Tue Sep 23 2003 - 07:50:33 EDT)
• [Snort-sigs] W32/SWEN.A signature pieter claassen (Tue Sep 23 2003 - 06:15:11 EDT)
• [Snort-sigs] correct of signature sid:1685 Choudhary, Anil (Tue Sep 23 2003 - 05:47:17 EDT)
• [Snort-sigs] Error in http://www.snort.org/snort-db/sid.html?sid=618 and 620 Knut Bjornstad (Tue Sep 23 2003 - 04:21:55 EDT)
• Re: [Snort-sigs] SNORT HELP Matt Kettler (Mon Sep 22 2003 - 11:16:30 EDT)
• [Snort-sigs] SID 556 RE-contrib (apologies; I misread the rule) Gene Gomez (Fri Sep 19 2003 - 13:53:19 EDT)
• [Snort-sigs] SID 615 contrib Gene Gomez (Fri Sep 19 2003 - 14:09:43 EDT)
• [Snort-sigs] SID 714 contrib Gene Gomez (Fri Sep 19 2003 - 14:37:48 EDT)
• [Snort-sigs] SID 557 contrib Gene Gomez (Fri Sep 19 2003 - 13:32:32 EDT)
• [Snort-sigs] SID 557 RE-contrib (apologies; I misread the rule) Gene Gomez (Fri Sep 19 2003 - 13:47:41 EDT)
• [Snort-sigs] SID 558 contrib (please note msg change; done for consistency with 556, 557, 559) Gene Gomez (Fri Sep 19 2003 - 13:54:50 EDT)
• [Snort-sigs] SID 559 contrib Gene Gomez (Fri Sep 19 2003 - 13:55:45 EDT)
• [Snort-sigs] SNORT HELP acastellani(at)riverwatch.com (Fri Sep 19 2003 - 15:02:07 EDT)
• [Snort-sigs] SID 556 contrib Gene Gomez (Fri Sep 19 2003 - 13:23:38 EDT)
• [Snort-sigs] Sig for Worm Swen.a? Robert Wagner (Mon Sep 22 2003 - 09:20:35 EDT)
• RE: [Snort-sigs] PortScan Logs Keen Joseph A1C HQ SSG/XOIN (Fri Sep 19 2003 - 07:20:26 EDT)
• [Snort-sigs] Rule Doc 1288 Neal Timm (Thu Sep 18 2003 - 14:18:01 EDT)
• [Snort-sigs] Re: Snort Rule signature file request nick black (Wed Sep 17 2003 - 18:04:36 EDT)
• [Snort-sigs] PortScan Logs Jayachandran K (Tue Sep 16 2003 - 15:48:58 EDT)
• Re: [Snort-sigs] DCOMRPC Exploit POC code posted Jason Alexander (Wed Sep 17 2003 - 23:06:24 EDT)
• [Snort-sigs] Snort Rule signature file request Jason Monroe \ (Wed Sep 17 2003 - 17:00:23 EDT)
• Re: FW: [Snort-sigs] Looking for a Yahoo Instant Messenger rule Snorkelpuss (Tue Sep 16 2003 - 10:47:26 EDT)
• Re: [Snort-sigs] DCOMRPC Exploit POC code posted SoloNet Newsfeed (Tue Sep 16 2003 - 10:29:13 EDT)
• [Snort-sigs] Netcat telnet attack signature (change 1) Graham, Jeffery A. MAJ - G6 (Thu Sep 11 2003 - 08:51:36 EDT)
• Re: [Snort-sigs] Looking for a Yahoo Instant Messenger rule Jade E. Deane (Mon Sep 15 2003 - 20:27:32 EDT)
• [Snort-sigs] Looking for a Yahoo Instant Messenger rule John Impallomeni (Mon Sep 15 2003 - 17:56:31 EDT)
• [Snort-sigs] DCOMRPC Exploit POC code posted SoloNet Newsfeed Processor (Mon Sep 15 2003 - 14:14:21 EDT)
• [Snort-sigs] Bluesocket remote admin signature Jon Hart (Mon Sep 15 2003 - 12:57:01 EDT)
• [Snort-sigs] Positive Technologies DCOM Buffer Overflow2 Signatures/Packets Eric Hines (Thu Sep 11 2003 - 16:43:24 EDT)
• RE: [Snort-sigs] rules licensing Milani Paolo (Fri Sep 12 2003 - 04:51:35 EDT)
• [Snort-sigs] Re: Snort-sigs digest, Vol 1 #698 - 11 msgs Aluru Madhuri (Fri Sep 12 2003 - 02:18:38 EDT)
• [Snort-sigs] snort-rules CURRENT update @ Thu Sep 11 22:18:58 2003 bmc(at)snort.org (Thu Sep 11 2003 - 22:18:58 EDT)
• [Snort-sigs] snort-rules STABLE update @ Thu Sep 11 22:18:58 2003 bmc(at)snort.org (Thu Sep 11 2003 - 22:18:58 EDT)
• Re: [Snort-sigs] rules licensing Brian (Thu Sep 11 2003 - 21:07:08 EDT)
• Re: [Snort-sigs] rules licensing (slightly off-topic pondering) Matt Kettler (Thu Sep 11 2003 - 16:34:17 EDT)
• Re: [Snort-sigs] Rule for the newest DCOM vulnerability? Brian (Thu Sep 11 2003 - 15:27:34 EDT)
• RE: [Snort-sigs] Rule for the newest DCOM vulnerability? Compton, Rich (Thu Sep 11 2003 - 15:31:19 EDT)
• RE: [Snort-sigs] Rule for the newest DCOM vulnerability? Eric Hines (Wed Sep 10 2003 - 23:39:59 EDT)
• Re: [Snort-sigs] quick rules for new dcom stuff Jason Haar (Thu Sep 11 2003 - 11:43:24 EDT)
• Re: [Snort-sigs] quick rules for new dcom stuff Sam Evans (Thu Sep 11 2003 - 09:42:45 EDT)
• Re: [Snort-sigs] quick rules for new dcom stuff Johnathan Norman (Thu Sep 11 2003 - 07:42:44 EDT)
• [Snort-sigs] update docs for sid 528 Jon Hart (Thu Sep 11 2003 - 01:44:09 EDT)
• [Snort-sigs] Rule for the newest DCOM vulnerability? Compton, Rich (Wed Sep 10 2003 - 23:02:47 EDT)
• [Snort-sigs] rules licensing Milani Paolo (Wed Sep 10 2003 - 13:20:58 EDT)
• [Snort-sigs] false negatives with SID 1882 (userid) Jon Hart (Sun Sep 07 2003 - 17:27:36 EDT)
• RE: [Snort-sigs] Unified output for barnyard Bamm Visscher (Fri Sep 05 2003 - 17:53:08 EDT)
• RE: [Snort-sigs] Unified output for barnyard Michael Miller (Fri Sep 05 2003 - 15:02:37 EDT)
• [Snort-sigs] Q on D Murdoch (Fri Sep 05 2003 - 08:36:00 EDT)
• Re: [Snort-sigs] sid 567 and new mail relay signatures Jon Hart (Thu Sep 04 2003 - 19:50:09 EDT)
• Re: [Snort-sigs] Unified output for barnyard Dusty Hall (Thu Sep 04 2003 - 17:16:40 EDT)
• [Snort-sigs] Unified output for barnyard Michael Miller (Thu Sep 04 2003 - 16:19:44 EDT)
• [Snort-sigs] P2P GNUTella GET causes lots of false positives Shane Smith (Thu Sep 04 2003 - 15:29:01 EDT)
• [Snort-sigs] sid 567 and new mail relay signatures Jon Hart (Thu Sep 04 2003 - 15:20:17 EDT)
• RE: [Snort-sigs] MUMU Robert Wagner (Thu Sep 04 2003 - 08:02:09 EDT)
• [Snort-sigs] MUMU mos def (Thu Sep 04 2003 - 06:33:26 EDT)
• [Snort-sigs] UPDATE: flexresp2 (new and improved active response for Snort) Jeff Nathan (Thu Sep 04 2003 - 05:59:24 EDT)
• Re: [Snort-sigs] spamassisan Matt Kettler (Wed Sep 03 2003 - 16:15:47 EDT)
• Re: Re: [Snort-sigs] quick question about Snort + ACID on FreeBSD Wes Young (Wed Sep 03 2003 - 15:21:24 EDT)
• RE: [Snort-sigs] snort rule update Gisler, Johnny (Wed Sep 03 2003 - 15:05:18 EDT)
• Re: [Snort-sigs] Re: Rule 498 and 1882 Brian (Wed Sep 03 2003 - 10:03:48 EDT)
• [Snort-sigs] Rule 498 and 1882 Giovanni (Tue Sep 02 2003 - 21:55:15 EDT)
• [Snort-sigs] Re: Rule 498 and 1882 Nigel Houghton (Wed Sep 03 2003 - 08:12:49 EDT)
• Re: [Snort-sigs] snort rule update Jade E. Deane (Tue Sep 02 2003 - 21:26:21 EDT)
• Re: [Snort-sigs] spamassisan Brian May (Tue Sep 02 2003 - 15:02:33 EDT)
• Re: Re: [Snort-sigs] quick question about Snort + ACID on FreeBSD delusi0n(at)bellsouth.net (Tue Sep 02 2003 - 11:44:30 EDT)
• [Snort-sigs] spamassisan Michael Scheidell (Tue Sep 02 2003 - 10:40:01 EDT)
• Re: [Snort-sigs] snort rule update Johnathan Norman (Tue Sep 02 2003 - 09:32:48 EDT)
• Re: [Snort-sigs] snort rule update Paul M. Sittler (Tue Sep 02 2003 - 09:25:11 EDT)
• Re: [Snort-sigs] repeated signatures? Johnathan Norman (Tue Sep 02 2003 - 09:37:51 EDT)
• [Snort-sigs] repeated signatures? keshav (Tue Sep 02 2003 - 03:32:52 EDT)
• [Snort-sigs] Snort Question Laura Scott (Mon Sep 01 2003 - 16:04:01 EDT)
• Re: [Snort-sigs] quick question about Snort + ACID on FreeBSD Irwan Hadi (Tue Sep 02 2003 - 04:41:59 EDT)
• [Snort-sigs] snort rule update Jeanne Mode (Mon Sep 01 2003 - 17:44:34 EDT)
• [Snort-sigs] quick question about Snort + ACID on FreeBSD <-delusion-> (Tue Sep 02 2003 - 01:13:08 EDT)
• [Snort-sigs] Re: That movie warchild(at)spoofed.org (Mon Sep 01 2003 - 06:34:49 EDT)
• [Snort-sigs] Possible new trojan Trent Whaley (Sun Sep 14 2003 - 03:38:30 EDT)