security.ids.snort.sigs (date)

October 31, 2002

Re: Sig ID 113 should have INTERNAL/EXTERNAL swapped., Mathew Johnston
Re: Sig ID 113 should have INTERNAL/EXTERNAL swapped., Mathew Johnston
Sig ID 113 should have INTERNAL/EXTERNAL swapped., Mathew Johnston
Re: Best snortsig for detecting FTP servers running on other port than 21?, Russell Fulton
RE: Best snortsig for detecting FTP servers running onother port than 21?, Marc Norton
Re: Best snortsig for detecting FTP servers running on other port than 21?, Mathew Johnston
Re: Snort signatures DB configuration management., Brian
Re: Combination of snort and argus, Brian
Re: Best snortsig for detecting FTP servers running on other port than 21?, Chris Green
Re: where is TFM?, Chris Green
Re: Best snortsig for detecting FTP servers running on other port than 21?, Brian

October 30, 2002

Re: Combination of snort and argus, Russell Fulton

October 29, 2002

Ridding ourselves of flags: A+, Kreimendahl, Chad J
Question about signature ID 107, Mathew Johnston
Snort signatures DB configuration management., Mathew Johnston
Signatures for mynetwatchman.com?, Dan Lawrence

October 28, 2002

Re: Combination of snort and argus, Russell Fulton
Re: where is TFM?, Daniel Roelker
where is TFM?, download (Jim Prewett)

October 25, 2002

FW: Teardrop sig needed, Daniel Roelker
Re: Teardrop sig needed, Daniel Roelker
Re: Teardrop sig needed, Daniel Roelker
Teardrop sig needed, Ed Davison
RE: friendgreetings.com signature, Matt Yackley
friendgreetings.com signature, Snort
Re: Combination of snort and argus, Matt Kettler
Re: Combination of snort and argus, Andreas Östling
Combination of snort and argus, KFC snort

October 24, 2002

Re: Snort-sigs digest, Vol 1 #382 - 3 msgs, Mike Cole
IE cached objects signatures, remember-handsworth
Re: scriptalias false positives for HTTP uploads, Russell Fulton
Re: scriptalias false positives for HTTP uploads, Steve Brown

October 23, 2002

Re: scriptalias false positives for HTTP uploads, Russell Fulton
scriptalias false positives for HTTP uploads, Steve Brown

October 22, 2002

X11 outbound client connection detected - remove from snort 1.9 r uleset?, Nanabhay Mohamed * Group (GP)

October 21, 2002

False triggers with 1.9 release, Russell Fulton

October 20, 2002

RE: ICMP L3retriever Ping, Andrew Hintz $Drew$
Re: false positives with Nimda rules [and fix], solarx
Re: code red sig mystery solved -- dsize query, Chris Green
SQL Injection signatures, Jean-Jacques Halans
ICMP L3retriever Ping, Lee, Charles R [MAJ] -- KY-ARNG
rule oddities, adam

October 18, 2002

Sorry, Madziarczyk, Jonathan

October 17, 2002

Streaming Media, Madziarczyk, Jonathan

October 16, 2002

code red sig mystery solved -- dsize query, Russell Fulton
Re: Kazaa Media Desktop Version *2*, Jeff Kell

October 15, 2002

Re: Kazaa Media Desktop Version *2*, Phillip G Deneault
Re: Kazaa Media Desktop Version *2*, spy guy
Kazaa Media Desktop Version *2*, Jack Vande Bunte
David Kibilka/Networking/Willich/Datasystems ist außer Haus., DKibilka

October 14, 2002

TTYPROMPT sig., Andreas Östling

October 13, 2002

sid 1881 spelling error, snort-sigs

October 11, 2002

Re: BugBear Sig, Erek Adams
BugBear Sig, O'Flynn, Derek
P2P, Ian Macdonald
Re: packets picked up by snort, Michael Scheidell
Re: packets picked up by snort, Moyer, Shawn
packets picked up by snort, Roanne Tang

October 10, 2002

RE: Yet another BugBear signature, larosa, vjay
Re: Snort 1.8 CVS rules vs. the snort-stable rules tar.gz, Chris Green
Re: Yet another BugBear signature, Chris Green
Re: Snort 1.8 CVS rules vs. the snort-stable rules tar.gz, Rich Adamson
RE: SID 660 - Bad Signature - (list of other similar sigs), Andrew Hintz $Drew$

October 09, 2002

Re: SID 660 - Bad Signature - (list of other similar sigs), Andrew Hintz $Drew$
RE: Yet another BugBear signature, larosa, vjay
RE: Yet another BugBear signature, larosa, vjay
Re: RE: [Snort-sigs] Current rule set for snort 1.8.7 netbios.rules -- Windows 2000 to Windows 2000 mapping detecting C$ and ADMIN$ whats the deal?, Chris Green
[Snort-users] RE: Current rule set for snort 1.8.7 netbios.rules -- Windows 2000 to Windows 2000 mapping detecting C$ and ADMIN$ whats the deal?, Giles Coochey
[Snort-users] Current rule set for snort 1.8.7 netbios.rules -- Windows 2000 to Windows 2000 mapping detecting C$ and ADMIN$ whats the deal?, Jake Schneider
[Snort-users] RE: Current rule set for snort 1.8.7 netbios.rules -- Windows 2000 to Windows 2000 mapping detecting C$ and ADMIN$ whats the deal?, Giles Coochey
Re: Snort 1.8 CVS rules vs. the snort-stable rules tar.gz, Chris Green
Re: Snort 1.8 CVS rules vs. the snort-stable rules tar.gz, Rich Adamson
here's a description for sid:105, Andrew Hintz $Drew$
Snort 1.8 CVS rules vs. the snort-stable rules tar.gz, Andrew Hintz $Drew$

October 08, 2002

Java and ActiveX signatures?, Andreas Hasenack

October 07, 2002

Re: New Bugbear virus/worm signature, Dragos Ruiu
Re: Yet another BugBear signature, Tim Bogart
RE: sig for CERT CA-2002-27 (OpenSSL worm probe), Coyle, Brian
Bugbear traffic capture, Shane Williams
Re: Apache Scalp distributing ->bugtrac.c UDP DOS tool sig yet?, Johannes Ullrich
hotmail logging, Lightship: Network Security
RE: Apache Scalp distributing ->bugtrac.c UDP DOS tool sig yet?, Arjen De Landgraaf
Re: sig for CERT CA-2002-27 (OpenSSL worm probe), Floodeen, Robert W Mr NISO/Seta
Tool for payload decoding from MySQL, Ed Davison
Yet another BugBear signature, Maccabeo
Re: Linux.Slapper.Worm, Shane Williams
New Bugbear virus/worm signature, Michael Brown
Re: sig for CERT CA-2002-27 (OpenSSL worm probe), Shane Williams
here's a description for sid:480, Andrew Hintz $Drew$
Re: SID 660 - Bad Signature, Michael Scheidell
SID 660 - Bad Signature, Robert Wagner
Re: SID 1676 - ORACLE union select attempt, Mark_Simmonds

October 06, 2002

false positives with Nimda rules [and fix], Jason Haar
Re: Autoupdate snort signature, Jason Haar

October 05, 2002

Re: Autoupdate snort signature (esa valimaki), Mercier, Yannick (CA - Montreal)

October 04, 2002

RE: Autoupdate snort signature, Russell Fulton
RE: Autoupdate snort signature, Moyer, Shawn
RE: Re: bugbear signature?, Trevor Daucsavage
RE: Autoupdate snort signature, Hicks, John
RE: Autoupdate snort signature, Kent Freeman
RE: Autoupdate snort signature, Robert Reid
Re: Autoupdate snort signature, Chris Green
Re: Autoupdate snort signature, Saad Kadhi
Re: Autoupdate snort signature, esa valimaki

October 03, 2002

Autoupdate snort signature, JJF lskd
Re: SID 1676 - ORACLE union select attempt, Chris Green
SID 1676 - ORACLE union select attempt, Mark_Simmonds

October 02, 2002

Re: bugbear signature?, Shane Williams
bugbear signature?, lcweinmunson
Re: Sig. For WORM_BUGBEAR.A, Tim Bogart
RE: Best snortsig for detecting FTP servers running on other port than 21?, McCammon, Keith
Re: Best snortsig for detecting FTP servers running on other port than 21?, Andreas Östling
Best snortsig for detecting FTP servers running on other port than 21?, Jonas Vreintaal
TCP Port 520 Exploit?, Hinson, Kurt

October 01, 2002

Sig. For WORM_BUGBEAR.A, Thorson Shane R Contr 75 CS/SCBS
RE: Need some help here gang...., Miller, Eoin
Signature for Opaserv Worm, Joe Stewart
RE: Need some help here gang...., Miller, Eoin
RE: Need some help here gang...., Hicks, John
Timestamp for replay mode of snort, Eddy Cheung
signatures for trojan, charella constansia