security.ids.snort.sigs (thread)

port list, JimF
- Re: port list, Brian
sid: 1113 - FPs, Paul Schmehl
Cywin SSH and EXPLOIT ssh CRC32 overflow filler, Grounds, Adam
Sid 1149 - too many FPs, Schmehl, Paul L
Sid 1634 - more FPs, Schmehl, Paul L
Sid 1042 - too many FPs, Schmehl, Paul L
snort-rules CURRENT update @ Thu Feb 27 06:25:07 2003, bmc
Sid:1845 IMAP list overflow attempt, Schmehl, Paul L
- Re: Sid:1845 IMAP list overflow attempt, Kenneth G. Arnold
- Re: Sid:1845 IMAP list overflow attempt, Michael Scheidell
- RE: Sid:1845 IMAP list overflow attempt, Schmehl, Paul L
  - RE: Sid:1845 IMAP list overflow attempt, Russell Fulton
  - RE: Sid:1845 IMAP list overflow attempt, Kenneth G. Arnold
  - Re: Sid:1845 IMAP list overflow attempt, Brian
- RE: Sid:1845 IMAP list overflow attempt, Schmehl, Paul L
Hello, and updating rules, FWAdmin
request a virus.rules file, terry xian
Payload, Michael . Advani
- Re: Payload, daniel.clemens
- RE: Payload, Michael . Advani
  - RE: Payload, Andrew Hintz \(Drew\)
Bug Bear Snort Sig...Not Confirmed, Snortmail
bugbear sig, Chris Rowe
Snort Virus Rules, Bill Westerhuis
- Re: Snort Virus Rules, Sam Evans
- Re: Snort Virus Rules, Matt Kettler
- Re: Snort Virus Rules, Sam Evans
  - Re: Snort Virus Rules, Sam Evans
Forget aging and dieting forever! 2574uXwe7-566hL-14, Lose Weight!
Re: [Packet-ninjas-syn-k1ck] Re: [Infragard-discussion] Port 17300 traffic, daniel.clemens
Re: RE: [Snort-users] More sid 1841, Matt Kettler
- Re: RE: [Snort-users] More sid 1841, Jon
- RE: RE: [Snort-users] More sid 1841, Schmehl, Paul L
  - RE: RE: [Snort-users] More sid 1841, Erek Adams
RE: More sid 1841, Schmehl, Paul L
Pass rule problem, Ian Macdonald
SID 1334, Anton Chuvakin
SID 1332, Anton Chuvakin
SID 1331, Anton Chuvakin
SID 1333, Anton Chuvakin
SID 1328, Anton Chuvakin
SID 1329, Anton Chuvakin
SID 1330, Anton Chuvakin
Scan on tcp 13000, Bob Dehnhardt
- Re: [Snort-sigs] Scan on tcp 13000, Michael Scheidell
RE: Portscan reporting, Robert Wagner
- RE: Portscan reporting, Antony J. Shepherd
- RE: Portscan reporting, Robert Wagner
  - RE: Portscan reporting, Antony J. Shepherd
- RE: Portscan reporting, Bamm Visscher
- Re: Portscan reporting, Detmar Liesen
Snort 1.9 "within:" option broken? (fwd), Carl Gibbons
- Re: Snort 1.9 "within:" option broken? (fwd), Chris Green
  - Portscan reporting, Antony J. Shepherd
  - Re: Snort 1.9 "within:" option broken? (fwd), Carl Gibbons
Simple TTL of 1 rules will not alert, Herman Munster
SID 331, Anton Chuvakin
SID 330, Anton Chuvakin
SID 329, Anton Chuvakin
SID 332, Anton Chuvakin
SID 1882, Anton Chuvakin
- Re: SID 1882, Jon
SID 1885, Anton Chuvakin
SID 1886, Anton Chuvakin
SID 1884, Anton Chuvakin
SID 1883, Anton Chuvakin
BUG! Rule 1677 triggers a bug when logging to mysql, Martin Olsson
- Re: [Snort-sigs] BUG! Rule 1677 triggers a bug when logging to mysql, Brian
(no subject), Carmit Partoush
- (no subject), Carmit Partoush
- Re: (no subject), Matt Kettler
- RE: (no subject), Carmit Partoush
- RE: (no subject), Matt Kettler
- RE: (no subject), Matt Kettler
- Re: (no subject), Henry B. Tindall, Jr.
Problem with pop3.rules and ftp.rules, Andrew J. Hobbs
- Re: Problem with pop3.rules and ftp.rules, Jens Krabbenhoeft
- Re: Problem with pop3.rules and ftp.rules, Kenneth G. Arnold
  - Re: Problem with pop3.rules and ftp.rules, Russell Fulton
    - Re: Problem with pop3.rules and ftp.rules, Frank Knobbe
    - Re: Problem with pop3.rules and ftp.rules, Chris Green
    - Re: Problem with pop3.rules and ftp.rules, Russell Fulton
    - Re: Problem with pop3.rules and ftp.rules, Chris Green
    - Re: Problem with pop3.rules and ftp.rules, Russell Fulton
    - Re: Problem with pop3.rules and ftp.rules, Jens Krabbenhoeft
new Q signature, Jon
- Re: new Q signature, Jon
  - Re: new Q signature, Jon
- RE: new Q signature, Hall, Andrew (DPRS)
  - Re: new Q signature, Jon
    - Re: new Q signature, Jason
    - Re: new Q signature, Jon
Locutus sigs?, Bob Dehnhardt
snort-rules STABLE update @ Mon Feb 10 11:01:01 2003, bmc
snort-rules CURRENT update @ Mon Feb 10 11:01:01 2003, bmc
RE: snort-rules STABLE update @ Fri Feb 7 17:33:38 2003, Michael . Advani
- Re: snort-rules STABLE update @ Fri Feb 7 17:33:38 2003, Brian
Re: Stopping outbound Kazaa, Gustavo Beltrami Rossi
- Re: Stopping outbound Kazaa, Travis S.
  - RE: Re: [Snort-users] Stopping outbound Kazaa [snort-users-admin@xxxxxxxxxxxxxxxxxxxxx in Pass-Through List] ['snort' in Pass-Through List] ['snort-users' in Pass-Through List], Steve Wray
    - RE: Re: [Snort-users] Stopping outbound Kazaa [snort-users-admin@xxxxxxxxxxxxxxxxxxxxx in Pass-Through List] ['snort' in Pass-Through List] ['snort-users' in Pass-Through List], daniel.clemens
  - Re: Stopping outbound Kazaa, Erek Adams
    - Re: Stopping outbound Kazaa, twig les
  - Re: [Snort-users] Stopping outbound Kazaa, Gustavo Beltrami Rossi
- RE: Stopping outbound Kazaa, Bob McDowell
SQL Slammer Worm Signature, Michael . Advani
- Re: SQL Slammer Worm Signature, John Sage
- RE: SQL Slammer Worm Signature, Michael . Advani
Sig to catch rogue SSH servers, Jon
- Re: Sig to catch rogue SSH servers, James Hoagland
Sig to locate rogue ftp servers, Jon
- Re: Sig to locate rogue ftp servers, Jukka Juslin
  - Re: Sig to locate rogue ftp servers, Jon
- RE: Sig to locate rogue ftp servers, O'Flynn, Derek
  - Re: Sig to locate rogue ftp servers, Brian
    - Re: Sig to locate rogue ftp servers, Jukka Juslin
    - Re: Sig to locate rogue ftp servers, Brian
false positives with sid 1992, Russell Fulton
snort-rules STABLE update @ Fri Feb 7 17:33:38 2003, bmc
- RE: snort-rules STABLE update @ Fri Feb 7 17:33:38 2003, Belthrop, Tony
  - Re: include help, Erek Adams
SID 407, Ruben Schattevoy
Rules current -> 1.9, Frank Knobbe
- Re: Rules current -> 1.9, Brian
  - Re: Rules current -> 1.9, Frank Knobbe
nimda / code red signatures, Jeff Oliveto
- Re: nimda / code red signatures, Phillip G Deneault
details about a sid, Rodrigo Buarque Ramos
- Re: details about a sid, Anne Carasik
  - Re: details about a sid, Nigel Houghton
- Re: details about a sid, Yaakov Yehudi
- RE: details about a sid, Steve Halligan
DNS rules, BUSO Massimo
sids in text format, Johnathan Norman
- Re: sids in text format, Jens Krabbenhoeft
False positives with SID 1337 and SID 1378, Jon
Rule-set merging, Keith T. Morgan
- Re: Rule-set merging, Erek Adams
Sid 2003, Michael Wright
- Re: Sid 2003, Erek Adams
- RE: Sid 2003, Michael . Advani
  - RE: Sid 2003, Erek Adams
- RE: Sid 2003, Yaakov Yehudi
receiving an error msg on a signature, nick nelson
- Re: receiving an error msg on a signature, Brian
- Re: receiving an error msg on a signature, Matt Kettler
SID 1627, Jon
SID 1520, Jon
Anti-IDS Rules patcher., Glenn Larsson
- Re: Anti-IDS Rules patcher., Brian