security.ids.snort.sigs (thread)

Sig ID 113 should have INTERNAL/EXTERNAL swapped., Mathew Johnston
- Re: Sig ID 113 should have INTERNAL/EXTERNAL swapped., Mathew Johnston
- Re: Sig ID 113 should have INTERNAL/EXTERNAL swapped., Mathew Johnston
Ridding ourselves of flags: A+, Kreimendahl, Chad J
Question about signature ID 107, Mathew Johnston
Snort signatures DB configuration management., Mathew Johnston
- Re: Snort signatures DB configuration management., Brian
Signatures for mynetwatchman.com?, Dan Lawrence
where is TFM?, download (Jim Prewett)
- Re: where is TFM?, Daniel Roelker
- Re: where is TFM?, Chris Green
Teardrop sig needed, Ed Davison
- Re: Teardrop sig needed, Daniel Roelker
- Re: Teardrop sig needed, Daniel Roelker
  - FW: Teardrop sig needed, Daniel Roelker
friendgreetings.com signature, Snort
- RE: friendgreetings.com signature, Matt Yackley
Combination of snort and argus, KFC snort
- Re: Combination of snort and argus, Andreas Östling
  - Re: Combination of snort and argus, Matt Kettler
- Re: Combination of snort and argus, Russell Fulton
  - Re: Combination of snort and argus, Russell Fulton
- Re: Combination of snort and argus, Brian
Re: Snort-sigs digest, Vol 1 #382 - 3 msgs, Mike Cole
IE cached objects signatures, remember-handsworth
scriptalias false positives for HTTP uploads, Steve Brown
- Re: scriptalias false positives for HTTP uploads, Russell Fulton
  - Re: scriptalias false positives for HTTP uploads, Steve Brown
    - Re: scriptalias false positives for HTTP uploads, Russell Fulton
X11 outbound client connection detected - remove from snort 1.9 r uleset?, Nanabhay Mohamed * Group (GP)
False triggers with 1.9 release, Russell Fulton
SQL Injection signatures, Jean-Jacques Halans
ICMP L3retriever Ping, Lee, Charles R [MAJ] -- KY-ARNG
- RE: ICMP L3retriever Ping, Andrew Hintz $Drew$
rule oddities, adam
Sorry, Madziarczyk, Jonathan
Streaming Media, Madziarczyk, Jonathan
code red sig mystery solved -- dsize query, Russell Fulton
- Re: code red sig mystery solved -- dsize query, Chris Green
Kazaa Media Desktop Version *2*, Jack Vande Bunte
- Re: Kazaa Media Desktop Version *2*, spy guy
  - Re: Kazaa Media Desktop Version *2*, Phillip G Deneault
    - Re: Kazaa Media Desktop Version *2*, Jeff Kell
David Kibilka/Networking/Willich/Datasystems ist außer Haus., DKibilka
TTYPROMPT sig., Andreas Östling
sid 1881 spelling error, snort-sigs
BugBear Sig, O'Flynn, Derek
- Re: BugBear Sig, Erek Adams
P2P, Ian Macdonald
packets picked up by snort, Roanne Tang
- Re: packets picked up by snort, Moyer, Shawn
  - Re: packets picked up by snort, Michael Scheidell
Re: RE: [Snort-sigs] Current rule set for snort 1.8.7 netbios.rules -- Windows 2000 to Windows 2000 mapping detecting C$ and ADMIN$ whats the deal?, Chris Green
[Snort-users] Current rule set for snort 1.8.7 netbios.rules -- Windows 2000 to Windows 2000 mapping detecting C$ and ADMIN$ whats the deal?, Jake Schneider
- [Snort-users] RE: Current rule set for snort 1.8.7 netbios.rules -- Windows 2000 to Windows 2000 mapping detecting C$ and ADMIN$ whats the deal?, Giles Coochey
- [Snort-users] RE: Current rule set for snort 1.8.7 netbios.rules -- Windows 2000 to Windows 2000 mapping detecting C$ and ADMIN$ whats the deal?, Giles Coochey
here's a description for sid:105, Andrew Hintz $Drew$
Snort 1.8 CVS rules vs. the snort-stable rules tar.gz, Andrew Hintz $Drew$
- Re: Snort 1.8 CVS rules vs. the snort-stable rules tar.gz, Rich Adamson
  - Re: Snort 1.8 CVS rules vs. the snort-stable rules tar.gz, Chris Green
    - Re: Snort 1.8 CVS rules vs. the snort-stable rules tar.gz, Rich Adamson
    - Re: Snort 1.8 CVS rules vs. the snort-stable rules tar.gz, Chris Green
Java and ActiveX signatures?, Andreas Hasenack
Bugbear traffic capture, Shane Williams
hotmail logging, Lightship: Network Security
RE: Apache Scalp distributing ->bugtrac.c UDP DOS tool sig yet?, Arjen De Landgraaf
- Re: Apache Scalp distributing ->bugtrac.c UDP DOS tool sig yet?, Johannes Ullrich
Tool for payload decoding from MySQL, Ed Davison
Yet another BugBear signature, Maccabeo
- Re: Yet another BugBear signature, Tim Bogart
- RE: Yet another BugBear signature, larosa, vjay
- RE: Yet another BugBear signature, larosa, vjay
  - Re: Yet another BugBear signature, Chris Green
- RE: Yet another BugBear signature, larosa, vjay
Re: Linux.Slapper.Worm, Shane Williams
New Bugbear virus/worm signature, Michael Brown
- Re: New Bugbear virus/worm signature, Dragos Ruiu
Re: sig for CERT CA-2002-27 (OpenSSL worm probe), Shane Williams
- Re: sig for CERT CA-2002-27 (OpenSSL worm probe), Floodeen, Robert W Mr NISO/Seta
- RE: sig for CERT CA-2002-27 (OpenSSL worm probe), Coyle, Brian
here's a description for sid:480, Andrew Hintz $Drew$
SID 660 - Bad Signature, Robert Wagner
- Re: SID 660 - Bad Signature, Michael Scheidell
  - Re: SID 660 - Bad Signature - (list of other similar sigs), Andrew Hintz $Drew$
    - RE: SID 660 - Bad Signature - (list of other similar sigs), Andrew Hintz $Drew$
false positives with Nimda rules [and fix], Jason Haar
- Re: false positives with Nimda rules [and fix], solarx
Re: Autoupdate snort signature (esa valimaki), Mercier, Yannick (CA - Montreal)
Autoupdate snort signature, JJF lskd
- Re: Autoupdate snort signature, esa valimaki
  - Re: Autoupdate snort signature, Saad Kadhi
  - Re: Autoupdate snort signature, Chris Green
- RE: Autoupdate snort signature, Robert Reid
  - RE: Autoupdate snort signature, Kent Freeman
  - RE: Autoupdate snort signature, Russell Fulton
    - Re: Autoupdate snort signature, Jason Haar
- RE: Autoupdate snort signature, Hicks, John
- RE: Autoupdate snort signature, Moyer, Shawn
SID 1676 - ORACLE union select attempt, Mark_Simmonds
- Re: SID 1676 - ORACLE union select attempt, Chris Green
- Re: SID 1676 - ORACLE union select attempt, Mark_Simmonds
bugbear signature?, lcweinmunson
- Re: bugbear signature?, Shane Williams
- RE: Re: bugbear signature?, Trevor Daucsavage
Best snortsig for detecting FTP servers running on other port than 21?, Jonas Vreintaal
- Re: Best snortsig for detecting FTP servers running on other port than 21?, Andreas Östling
  - Re: Best snortsig for detecting FTP servers running on other port than 21?, Brian
    - Re: Best snortsig for detecting FTP servers running on other port than 21?, Chris Green
    - Re: Best snortsig for detecting FTP servers running on other port than 21?, Mathew Johnston
    - RE: Best snortsig for detecting FTP servers running onother port than 21?, Marc Norton
    - Re: Best snortsig for detecting FTP servers running on other port than 21?, Russell Fulton
- RE: Best snortsig for detecting FTP servers running on other port than 21?, McCammon, Keith
TCP Port 520 Exploit?, Hinson, Kurt
Sig. For WORM_BUGBEAR.A, Thorson Shane R Contr 75 CS/SCBS
- Re: Sig. For WORM_BUGBEAR.A, Tim Bogart
Signature for Opaserv Worm, Joe Stewart
RE: Need some help here gang...., Hicks, John
- RE: Need some help here gang...., Miller, Eoin
- RE: Need some help here gang...., Miller, Eoin
Timestamp for replay mode of snort, Eddy Cheung
signatures for trojan, charella constansia