Mailing List Archive For snort-sigs@snort.org Mar 2004 By Thread

• Re: [Snort-sigs] snort whitelist Michael Richardson (Wed Mar 31 2004 - 10:23:46 EST)
• [Snort-sigs] False positive on rules SID=2182 Patrick Monfette (Wed Mar 31 2004 - 08:56:24 EST)
• [Snort-sigs] WEB-IIS Translate update... Erik Fichtner (Wed Mar 31 2004 - 15:53:40 EST)
• [Snort-sigs] Some intresting stats on base components of rules Sean Wheeler (Wed Mar 31 2004 - 14:11:22 EST)
• Re: [Snort-sigs] Simple Question!! Nigel Houghton (Wed Mar 31 2004 - 13:04:53 EST)
• Re: [Snort-sigs] Simple Question!! SAM IDS (Wed Mar 31 2004 - 12:11:51 EST)
• Re: [Snort-sigs] Simple Question!! Nigel Houghton (Tue Mar 30 2004 - 10:11:00 EST)
• [Snort-sigs] Simple Question!! SAM IDS (Mon Mar 29 2004 - 23:18:52 EST)
• [Snort-sigs] Simple Question!! SAM IDS (Mon Mar 29 2004 - 23:28:31 EST)
• Re: [Snort-sigs] Need Some Explanation about Sigs Brian (Mon Mar 29 2004 - 13:22:25 EST)
• Re: [Snort-sigs] Need Some Explanation about Sigs Alejandro Flores (Mon Mar 29 2004 - 11:48:32 EST)
• [Snort-sigs] Snort-sigs -- confirmation of subscription -- request 711881 Scott Weller (Mon Mar 29 2004 - 10:21:11 EST)
• [Snort-sigs] Flex Response + NIC Dusty Hall (Mon Mar 29 2004 - 09:41:12 EST)
• Re: [Snort-sigs] Snort SIG update - false positives on SID 2329 Nigel Houghton (Mon Mar 29 2004 - 09:25:51 EST)
• [Snort-sigs] Snort SIG update - false positives on SID 2329 Dr. Christoph Wegener (Fri Mar 26 2004 - 03:57:50 EST)
• [Snort-sigs] Re: [ISSForum] Witty signature Sergey V Soldatov (Thu Mar 25 2004 - 08:45:59 EST)
• [Snort-sigs] Need Some Explanation about Sigs SAM IDS (Mon Mar 29 2004 - 05:31:21 EST)
• [Snort-sigs] some corrections to rules incorrectly refering to a reference resource not located in etc/reference.config Sean Wheeler (Sun Mar 28 2004 - 10:19:07 EST)
• [Snort-sigs] Does rules 2159 make sense ? Sean Wheeler (Sun Mar 28 2004 - 11:25:05 EST)
• Re: [Snort-sigs] writing signatures from isolated viruses Jason Haar (Thu Mar 25 2004 - 20:57:01 EST)
• Re: [Snort-sigs] writing signatures from isolated viruses pieter claassen (Thu Mar 25 2004 - 18:26:30 EST)
• [Snort-sigs] writing signatures from isolated viruses Cory Hollingsworth (Thu Mar 25 2004 - 18:06:26 EST)
• [Snort-sigs] False positive found for rule side=1634 Bobby Kuzma (Thu Mar 25 2004 - 17:44:45 EST)
• Re: [Snort-sigs] snort whitelist Carl Gibbons (Thu Mar 25 2004 - 11:07:41 EST)
• Re: [Snort-sigs] snort whitelist Dale L. Handy (Thu Mar 25 2004 - 13:24:59 EST)
• Re: [Snort-sigs] error running snort Dale L. Handy (Thu Mar 25 2004 - 13:19:58 EST)
• Re: [Snort-sigs] Help Alberto Gonzalez (Thu Mar 25 2004 - 12:58:58 EST)
• Re: [Snort-sigs] snort whitelist frank(at)betaversion.net (Thu Mar 25 2004 - 09:44:34 EST)
• [Snort-sigs] Slight mistake in SID 2197 Christian Robottom Reis (Wed Mar 24 2004 - 10:16:39 EST)
• [Snort-sigs] error running snort MEGA Hospedagem (Tue Mar 23 2004 - 16:36:22 EST)
• [Snort-sigs] Re: [ISSForum] Witty signature Sergey V Soldatov (Tue Mar 23 2004 - 09:45:17 EST)
• [Snort-sigs] Help Rodrigo Albernaz Bezerra (Tue Mar 23 2004 - 10:45:15 EST)
• [Snort-sigs] snort whitelist MEGA Hospedagem (Tue Mar 23 2004 - 20:37:15 EST)
• [Snort-sigs] Any signatures for msclock.exe ? Meinecke, Dennis (Tue Mar 23 2004 - 08:43:27 EST)
• [Snort-sigs] Duplicate 732 Hugo van der Kooij (Thu Mar 25 2004 - 01:47:33 EST)
• RE: [Snort-sigs] Netsky.P Signature Adrian Marsden (Wed Mar 24 2004 - 08:12:42 EST)
• Re: [Snort-sigs] Netsky.P Signature Jason Haar (Tue Mar 23 2004 - 20:30:36 EST)
• Re: [Snort-sigs] Netsky.P Signature Mark.Schutzmann(at)Omron.com (Tue Mar 23 2004 - 09:03:26 EST)
• Re: [Snort-sigs] Netsky.P Signature Brian (Mon Mar 22 2004 - 19:36:57 EST)
• [Snort-sigs] Netsky.P Signature Cam Beasley, ISO (Mon Mar 22 2004 - 17:24:29 EST)
• [Snort-sigs] snort-rules 2.1.* update @ Mon Mar 22 14:15:27 2004 bmc(at)snort.org (Mon Mar 22 2004 - 14:15:27 EST)
• [Snort-sigs] snort-rules CURRENT update @ Sat Mar 20 20:15:26 2004 bmc(at)snort.org (Sat Mar 20 2004 - 20:15:26 EST)
• [Snort-sigs] False positive generated on SID 2329 Jonathon Leszczynski (Fri Mar 19 2004 - 11:05:47 EST)
• [Snort-sigs] Performance Monitor Rodrigo B. Ramos (Sun Mar 21 2004 - 21:19:00 EST)
• Re: [Snort-sigs] Witty signature Jason (Sun Mar 21 2004 - 10:31:37 EST)
• Re: [Snort-sigs] Witty signature todb(at)planb-security.net (Sun Mar 21 2004 - 10:18:11 EST)
• Re: [Snort-sigs] Witty signature Russell Fulton (Sat Mar 20 2004 - 20:47:37 EST)
• Re: [Snort-sigs] Witty signature Brian (Sat Mar 20 2004 - 16:57:10 EST)
• Re: [Snort-sigs] Witty signature todb(at)planb-security.net (Sat Mar 20 2004 - 12:01:08 EST)
• [Snort-sigs] Witty signature todb(at)planb-security.net (Sat Mar 20 2004 - 06:17:35 EST)
• [Snort-sigs] ACID Response Table Bug King Jr, Charles (Contractor) (Fri Mar 19 2004 - 12:50:12 EST)
• Re: [Snort-sigs] false positives for attack-response rules (and suggested fix) Brian (Fri Mar 19 2004 - 12:02:10 EST)
• Re: [Snort-sigs] pcre syntax error for sid 1229 Brian (Fri Mar 19 2004 - 12:00:57 EST)
• [Snort-sigs] Re: Hi bmc(at)snort.org (Fri Mar 19 2004 - 11:24:51 EST)
• RE: [Snort-sigs] query Michael Miller (Fri Mar 19 2004 - 10:36:22 EST)
• [Snort-sigs] query jayarajd (Thu Mar 18 2004 - 03:44:20 EST)
• [Snort-sigs] false positives for attack-response rules (and suggested fix) Milani Paolo (Fri Mar 19 2004 - 07:56:10 EST)
• [Snort-sigs] pcre syntax error for sid 1229 Milani Paolo (Fri Mar 19 2004 - 07:47:47 EST)
• [Snort-sigs] Hidden message bmc(at)snort.org (Thu Mar 18 2004 - 22:40:21 EST)
• [Snort-sigs] Re: Hi bmc(at)snort.org (Thu Mar 18 2004 - 19:20:44 EST)
• [Snort-sigs] Hotbar Rowland, Krisa W ERDC-ITL-MS Contractor (Thu Mar 18 2004 - 15:58:49 EST)
• RE: [Snort-sigs] Anonymous Proxy Server Detection Kreimendahl, Chad J (Thu Mar 18 2004 - 11:33:39 EST)
• [Snort-sigs] Anonymous Proxy Server Detection eric.ferguson(at)jaguartech.com (Wed Mar 17 2004 - 17:29:51 EST)
• [Snort-sigs] Phatbot Sigs Dan Michitsch (Wed Mar 17 2004 - 16:28:18 EST)
• Re: [Snort-sigs] Question about rule 1549 Federico Petronio (Wed Mar 17 2004 - 15:17:41 EST)
• [Snort-sigs] Threshold in signatures Roach4 (Wed Mar 17 2004 - 08:37:23 EST)
• RE: [Snort-sigs] A question about comparing IDSs Martin Dion (Tue Mar 16 2004 - 09:27:12 EST)
• [Snort-sigs] snort rule 2329 Ekblad, Eric M (Mon Mar 15 2004 - 17:10:37 EST)
• RE: [Snort-sigs] A question about comparing IDSs Yaakov Yehudi (Tue Mar 16 2004 - 07:24:55 EST)
• [Snort-sigs] A question about comparing IDSs Islam Hegazy (Tue Mar 16 2004 - 04:20:46 EST)
• [Snort-sigs] FP on "NETBIOS DCERPC Remote Activation bind attempt" Jason Haar (Mon Mar 15 2004 - 15:35:41 EST)
• [Snort-sigs] Phatbot signatures Joe Stewart (Mon Mar 15 2004 - 14:59:06 EST)
• [Snort-sigs] FP on sid=535 Jason Haar (Mon Mar 15 2004 - 10:44:47 EST)
• [Snort-sigs] Rule naming inconsistancy for C$/D$ SMB access Jason Haar (Mon Mar 15 2004 - 11:15:06 EST)
• Re: [Snort-sigs] Question about rule 1549 Brian (Mon Mar 15 2004 - 09:04:21 EST)
• Re: [Snort-sigs] Shouldn't all chat.rules be "policy violation"? Brian (Mon Mar 15 2004 - 08:55:35 EST)
• [Snort-sigs] Shouldn't all chat.rules be "policy violation"? Jason Haar (Mon Mar 15 2004 - 04:26:31 EST)
• [Snort-sigs] FP with sid=2403 Jason Haar (Sun Mar 14 2004 - 16:55:00 EST)
• Re: [Snort-sigs] detection time Hugo van der Kooij (Sun Mar 14 2004 - 14:45:20 EST)
• [Snort-sigs] detection time Islam Hegazy (Sun Mar 14 2004 - 10:51:23 EST)
• [Snort-sigs] detection time Islam Hegazy (Sat Mar 13 2004 - 07:54:30 EST)
• [Snort-sigs] Sid 2343 Steven Alexander (Fri Mar 12 2004 - 17:59:41 EST)
• Re: [Snort-sigs] Documentation sid 2337 Nigel Houghton (Fri Mar 12 2004 - 17:49:23 EST)
• [Snort-sigs] Sid 2340 Steven Alexander (Fri Mar 12 2004 - 17:50:37 EST)
• Re: [Snort-sigs] False positive Hugo van der Kooij (Fri Mar 12 2004 - 17:06:41 EST)
• [Snort-sigs] Sid 2337, again Steven Alexander (Fri Mar 12 2004 - 14:15:32 EST)
• [Snort-sigs] Sid 2338 Steven Alexander (Fri Mar 12 2004 - 14:14:20 EST)
• [Snort-sigs] Documentation sid 2337 Steven Alexander (Fri Mar 12 2004 - 14:03:43 EST)
• [Snort-sigs] Question about rule 1549 Federico Petronio (Fri Mar 12 2004 - 10:14:33 EST)
• RE: [Snort-sigs] imesh signature? Tony Hernandez (Fri Mar 12 2004 - 10:11:37 EST)
• [Snort-sigs] snort ID: 525 BAD-TRAFFIC udp port 0 traffic Ilango S Allikuzhi (Mon Mar 08 2004 - 16:15:28 EST)
• [Snort-sigs] False positive generated on SID 2329 Jonathon Leszczynski (Tue Mar 09 2004 - 09:16:22 EST)
• [Snort-sigs] False positive Michaël Catroux (Wed Mar 10 2004 - 08:39:36 EST)
• [Snort-sigs] Sid:628 update suggestion Affeld, James (Mon Mar 08 2004 - 19:34:12 EST)
• [Snort-sigs] False positive on SID 1561 (pcap attached) JStarke(at)benco.com (Thu Mar 11 2004 - 10:10:06 EST)
• [Snort-sigs] imesh signature? Jasmine CHUA (Wed Mar 10 2004 - 02:51:06 EST)
• [Snort-sigs] Sober.D - a new variant Chintan Gosalia (Tue Mar 09 2004 - 17:08:06 EST)
• [Snort-sigs] Bad rule... Bad bad rule Kreimendahl, Chad J (Tue Mar 09 2004 - 12:15:29 EST)
• Re: [Snort-sigs] Help Jimmi Andersen (Mon Mar 08 2004 - 16:00:21 EST)
• Re: [Snort-sigs] Pure Not Rule not Supported? Matt Kettler (Mon Mar 08 2004 - 15:14:46 EST)
• Re: [Snort-sigs] Pure Not Rule not Supported? Michael Sconzo (Mon Mar 08 2004 - 11:32:39 EST)
• [Snort-sigs] Pure Not Rule not Supported? Amanda Meyer (Thu Mar 04 2004 - 13:01:48 EST)
• Re: [Snort-sigs] pass rules Dale L. Handy (Thu Mar 04 2004 - 12:41:09 EST)
• Re: [Snort-sigs] Re: W32.Beagle.J Worm Signature? Mark.Schutzmann(at)Omron.com (Thu Mar 04 2004 - 10:49:42 EST)
• RE: [Snort-sigs] W32.Beagle.J Worm Signature? Cam Beasley, ISO (Thu Mar 04 2004 - 07:49:36 EST)
• [Snort-sigs] Re: W32.Beagle.J Worm Signature? RuthAnne Bevier (Thu Mar 04 2004 - 00:54:32 EST)
• Re: [Snort-sigs] W32.Beagle.J Worm Signature? Jason Haar (Wed Mar 03 2004 - 19:13:52 EST)
• Re: [Snort-sigs] W32.Beagle.J Worm Signature? Hugo van der Kooij (Wed Mar 03 2004 - 16:32:17 EST)
• [Snort-sigs] W32.Beagle.J Worm Signature? Mark.Schutzmann(at)Omron.com (Wed Mar 03 2004 - 15:45:50 EST)
• Re: [Snort-sigs] Netsky.c + others? attachment sid John B. (Wed Mar 03 2004 - 15:28:32 EST)
• Re: [Snort-sigs] Netsky.c + others? attachment sid Hugo van der Kooij (Wed Mar 03 2004 - 14:18:02 EST)
• Re: [Snort-sigs] pass rules John B. (Wed Mar 03 2004 - 11:50:52 EST)
• [Snort-sigs] pass rules Rowland, Krisa W ERDC-ITL-MS Contractor (Wed Mar 03 2004 - 10:45:57 EST)
• Re: [Snort-sigs] Netsky.c + others? attachment sid John B. (Wed Mar 03 2004 - 10:16:07 EST)
• Re: [Snort-sigs] Netsky.c + others? attachment sid Hugo van der Kooij (Tue Mar 02 2004 - 17:13:24 EST)
• Re: [Snort-sigs] Netsky.c + others? attachment sid John B. (Tue Mar 02 2004 - 15:44:15 EST)
• Re: [Snort-sigs] Netsky.c + others? attachment sid John B. (Tue Mar 02 2004 - 13:30:44 EST)
• Re: [Snort-sigs] Here are some Netsky Worm Sigs Mark.Schutzmann(at)Omron.com (Mon Mar 01 2004 - 16:55:44 EST)
• [Snort-sigs] Netsky.c + others? attachment sid Scott Zawalski (Mon Mar 01 2004 - 14:41:36 EST)
• [Snort-sigs] snort-rules 2.1.* update @ Mon Mar 1 14:15:28 2004 bmc(at)snort.org (Mon Mar 01 2004 - 14:15:28 EST)
• Re: [Snort-sigs] Here are some Netsky Worm Sigs Tom.Mclaughlin(at)kp.org (Mon Mar 01 2004 - 12:20:35 EST)
• [Snort-sigs] snort-rules CURRENT update @ Mon Mar 1 09:40:19 2004 bmc(at)snort.org (Mon Mar 01 2004 - 09:40:19 EST)
• [Snort-sigs] snort-rules 2.1.* update @ Mon Mar 1 09:40:19 2004 bmc(at)snort.org (Mon Mar 01 2004 - 09:40:19 EST)