security.ids.snort.sigs (thread)

anyone have a good Swen sig, Philip Davidson
updated MS-RDP signature?, Charles Hamby
- Re: updated MS-RDP signature?, Andreas Östling
RADIO, al00884047
RE: RESP error, JOHNSON DAVID R
- Re: RE: RESP error, Brian A Kee
- RE: RE: RESP error, SRH-Lists
  - Re: RE: RESP error, Jeff Nathan
RPM config, JOHNSON DAVID R
RE: Snort-sigs digest, Vol 1 #747 - 9 msgs, John Impallomeni
W32.Dumaru Sig, Nick Duda
- Re: W32.Dumaru Sig, Nigel Houghton
- Re: W32.Dumaru Sig, Erwin Van de Velde
- RE: W32.Dumaru Sig, Nick Duda
TCPDUMP.LOG, al00884047
- Re: TCPDUMP.LOG, Matt Kettler
RE: Inverted list of IPs, Nick Duda
- Inverted list of IPs, Martin Olsson
2251 and 2252 in netbios.rules, Gregory S Thomas
Please help!!, hlima
Active Response in what version?, Shane Smith
- Re: Active Response in what version?, Geoff
- Re: Active Response in what version?, Matt Kettler
  - Re: Active Response in what version?, Dan Monjar
    - Re: Active Response in what version?, Matt Kettler
    - Re: Active Response in what version?, Jeff Nathan
pass rules, edmund . li
- Re: pass rules, Matt Kettler
RE: Few posistives on several rules on POP3 + The Ta o of Snort-Sigs, Moyer, Shawn
snort*rpm with snortsam and all other goodies, Alexandru Balan
- Re: snort*rpm with snortsam and all other goodies, Matt Kettler
- Re: snort*rpm with snortsam and all other goodies, Bennett Todd
Few posistives on several rules on POP3, Cedric Foll
- Re: Few posistives on several rules on POP3, Chris Green
  - Re: Few posistives on several rules on POP3, Cedric Foll
    - Re: Few posistives on several rules on POP3, Chris Green
    - Re: Few posistives on several rules on POP3, Cedric Foll
- RE: Few posistives on several rules on POP3, Jacob Roberts
  - RE: Few posistives on several rules on POP3, Erek Adams
    - RE: Few posistives on several rules on POP3, Cedric Foll
snort-rules CURRENT update @ Tue Oct 21 02:15:23 2003, bmc
snort-rules STABLE update @ Tue Oct 21 02:15:23 2003, bmc
- Re: snort-rules STABLE update @ Tue Oct 21 02:15:23 2003, Hugo van der Kooij
  - Re: snort-rules STABLE update @ Tue Oct 21 02:15:23 2003, Andreas Östling
    - Re: snort-rules STABLE update @ Tue Oct 21 02:15:23 2003, Brian
snort-rules STABLE update @ Tue Oct 21 11:15:16 2003, bmc
- Re: snort-rules STABLE update @ Tue Oct 21 11:15:16 2003, stephane
MS Messenger Overflow (MS03-043) POC sig, Mike Pomraning
- Re: MS Messenger Overflow (MS03-043) POC sig, Sam Evans
  - Re: MS Messenger Overflow (MS03-043) POC sig, Michael J. Pomraning
- Re: MS Messenger Overflow (MS03-043) POC sig, Michael J. Pomraning
update of snort rules with pcre, Cedric Foll
- Re: update of snort rules with pcre, Brian
  - Re: update of snort rules with pcre, Frank Knobbe
    - Re: update of snort rules with pcre, Chris Green
    - Re: update of snort rules with pcre, Martin Olsson
    - Re: update of snort rules with pcre, Frank Knobbe
    - Re: update of snort rules with pcre, Brian
How to update my rules, Philip Nedev
- Re: How to update my rules, Nigel Houghton
Scanning machine, d'Ambly, Jeff
- Re: Scanning machine, Chris Reining
  - False positive: NETBIOS DCERPC ISystemActivator bind attempt, Aaron Ferguson
- Re: Scanning machine, Erick Mechler
Updated snort.server script, Jeff Nathan
RP3 EXPLOIT signature, Manuel Garcia-Cervigon
False Positives/Packet Conversations, Jacob Roberts
Re: Problems with thresholding configuration command (Annual Leave), Justin Hennessy
Problems with thresholding configuration command, Brian Raines
- Re: Problems with thresholding configuration command, Chris Green
Snort Logs, Martin Jr., D. Michael
- Re: Snort Logs, Matt Kettler
- RE: Snort Logs, Martin Jr., D. Michael
- RE: Snort Logs, Martin Jr., D. Michael
Stopping P2P Traffic, Lepich, Jesse A Mr GLWACH
- Re: Stopping P2P Traffic, Cedric Foll
Monte Toren is out of the office., mtoren
event_id, Martin Jr., D. Michael
- Re: event_id, Matt Kettler
Signature for credit card numbers, Cove Schneider
- Re: Signature for credit card numbers, Sean Perry
  - Re: Signature for credit card numbers, Cove Schneider
    - Re: Signature for credit card numbers, Brian
    - Re: Signature for credit card numbers, Brian
    - Re: Signature for credit card numbers, Paul Tinsley
    - Re: Signature for credit card numbers, Cove Schneider
- RE: Signature for credit card numbers, Adam Towarnyckyj
- RE: Signature for credit card numbers, Eric Kuhnke
  - Re: Signature for credit card numbers, Cove Schneider
- Signature for credit card numbers, keith loyd
  - Re: Signature for credit card numbers, Brian Coyle
unsubscibe, Mattison Ward
Possible False on Zone Transfer, wbradd
- Re: Possible False on Zone Transfer, Bryan Irvine
Snort Start Error, Grimm, Paul F
- Re: Snort Start Error, Mike Messick
- Re: Snort Start Error, Matt Kettler
Common encrytpion Identification?, Tony Hernandez
- Re: Common encrytpion Identification?, Matt Kettler
detect edonkey, Cedric Foll
- Re: detect edonkey, Nigel Houghton
  - Re: detect edonkey, Cedric Foll
Rob Flentge/Mechanicsburg/US/Exel is out of the office., Rob Flentge
false positive: WEB-FRONTPAGE fourdots request, Hugo van der Kooij
- Re: false positive: WEB-FRONTPAGE fourdots request, Matt Kettler
  - Re: false positive: WEB-FRONTPAGE fourdots request, Joe Stewart
- Re: false positive: WEB-FRONTPAGE fourdots request, Nigel Houghton
  - Re: false positive: WEB-FRONTPAGE fourdots request, Hugo van der Kooij
- Re: false positive: WEB-FRONTPAGE fourdots request, dmitriy . dunavetsky
snort rule question: welchia worm, Tony Blackmon
- RE: snort rule question: welchia worm, Nick Duda
snort 2.0 windows ver, rpolaski
- RE: snort 2.0 windows ver, Keith Pachulski
False positive on SID 469 (ICMP ping nmap), Niklas Schiffler
- Re: False positive on SID 469 (ICMP ping nmap), Nigel Houghton
- RE: False positive on SID 469 (ICMP ping nmap), Wyatt Neal
invalid references in snort rules, Mark McDonagh
- RE: invalid references in snort rules, Michael Pacheco
  - RE: invalid references in snort rules, Nigel Houghton
how do you configure the snmp.rules?, Chris Talaski
ARP scan, Martin Jr., D. Michael
- Re: ARP scan, Nigel Houghton
- Re: ARP scan, Landon Lewis
- Re: ARP scan, Mark Nipper
- Re: ARP scan, Jeff Nathan
- RE: ARP scan, Martin Jr., D. Michael
  - Re: ARP scan, Mark Nipper
RE: Whitehats rules versus Snort.org rules, Gisler, Johnny
- Re: Whitehats rules versus Snort.org rules, Jeff Nathan
  - Re: Whitehats rules versus Snort.org rules, Matt Kettler
Re: [Full-Disclosure] Mystery DNS Changes, Paul Tinsley
- Whitehats rules versus Snort.org rules, Jukka Juslin
  - Re: Whitehats rules versus Snort.org rules, Brian
  - Re: Whitehats rules versus Snort.org rules, Matt Kettler
- Re: Re: [Full-Disclosure] Mystery DNS Changes, Paul Tinsley
  - Re: [Snort-sigs] Re: Mystery DNS Changes, Paul Schmehl
    - Re: Re: [Full-Disclosure] Mystery DNS Changes, Paul Tinsley
    - Re: Re: [Full-Disclosure] Mystery DNS Changes, Paul Schmehl
DNS abnormalitities - Potential NEW Worm??, DasPadre
Idea or two for eDonkey [WAS: RE: Using snort to Identify P2P transfers.], Stephen Briggs
RE: Using snort to Identify P2P transfers., Tony Hernandez
- Re: Using snort to Identify P2P transfers., dmitriy . dunavetsky
  - Re: Using snort to Identify P2P transfers., Nigel Houghton
    - Re: Using snort to Identify P2P transfers., Dan Monjar
    - Re: Using snort to Identify P2P transfers., Nigel Houghton
- Re: Using snort to Identify P2P transfers., dmitriy . dunavetsky
- Re: Using snort to Identify P2P transfers., nlloyd