security.ids.snort.sigs (date)

December 31, 2003

RE: Virus rules update, Nick Duda

December 30, 2003

Anybody using the react keyword in 2.1?, David Gianndrea
Re: false positives for sigs 2259 & 2260, Brian
False Positive Information, Nigel Houghton
Re: POLICY VNC server response, Nigel Houghton
False positive on rule 298, STEPHEN W. COREY - 5535
Update for sid 1394 - false positive update, hitman
sid: 1239, Maarten Van Horenbeeck
Sid 1841, Field, Gregory L.
Virus rules update, Basem AlSaeed
False positives in rule for P2P Gnutella (1432), Javier Fernandez-Sanguino
Fwd: false positive for #615, james
sid 1635: POP3 APOP overflow attempt, Maarten Van Horenbeeck
POLICY VNC server response, Sam Adams
Additional information for sid 1042, Javier Fernandez-Sanguino
sid 1634 - POP3 PASS overflow attempt, Maarten Van Horenbeeck
false positives for sigs 2259 & 2260, lpj0508
Possible false positives experienced on rule SID 1841 ???, b

December 29, 2003

RE: [Snort-sigs] Re: Signature error?, Ron Shuck
Re: Signature error?, Jon Hart
Signature error?, Ron Shuck
Re: DDOS false positive, Nigel Houghton
Re: DDOS false positive, Askin, Hank - XICN
Re: DDOS false positive, Knut Bjornstad

December 28, 2003

Re: DDOS false positive, Nigel Houghton

December 26, 2003

DDOS false positive, Bryan Irvine

December 23, 2003

Re: Help to configure SNORT, Matt Kettler
Help to configure SNORT, Lorenzo Rossi
upate for sid 1432, Russell Fulton

December 22, 2003

SID 1635: POP3 APOP overflow attempt (documentation), Maarten Van Horenbeeck
SID 1634: POP3 PASS overflow attempt (documentation), Maarten Van Horenbeeck
SID 1239: NetBIOS RFParalyze Attempt (documentation), Maarten Van Horenbeeck
Re: Snort rules update procedure, Matt Kettler
snort-rules STABLE update @ Mon Dec 22 13:15:21 2003, bmc
snort-rules CURRENT update @ Mon Dec 22 13:15:21 2003, bmc
Re: please remove me from your user email list. Thanks, Matt Kettler
please remove me from your user email list. Thanks, gfyspf@xxxxxxxxx
RE: Documentation for Rule 488 INFO Connection Close d MSG from Port 80, Sean Batt

December 20, 2003

RE: Documentation for Rule 488 INFO Connection Close d MSG from Port 80, Nathan Bain
RE: Documentation for Rule 488 INFO Connection Close d MSG from Port 80, Adams, Samuel (contractor)

December 18, 2003

snort-rules CURRENT update @ Thu Dec 18 13:15:19 2003, bmc

December 17, 2003

Re: Update to signature, Nigel Houghton
Snort rules update procedure, Javi Mesquida
Update to signature, Tim Vienneau
snort-rules CURRENT update @ Tue Dec 16 19:15:20 2003, bmc

December 16, 2003

RE: if match on rule don't log or something like tha t, Federico Castañeda
if match on rule don't log or something like that, Alexandru Balan

December 15, 2003

Re: Re: pcre (was:To build a logical AND expression), Daniel J. Roelker
Re: pcre (was:To build a logical AND expression), Martin Olsson
SID 365 does False Positive, Jon Banks
Re: To build a logical AND expression, Brian
Re: Offset, Dirk Geschke
Re: Offset, Devilscrow Sr
Re: Offset, Dirk Geschke
Re: Offset, Devilscrow Sr
To build a logical AND expression, Martin Olsson
Offset, Martin Olsson
Re: Documentation for Rule 488 INFO Connection Closed MSG from Port 80, Brian

December 14, 2003

Re: Documentation for Rule 488 INFO Connection Closed MSG from Port 80, Russell Fulton
Re: rules for physical intruders, Hugo van der Kooij
Re: Documentation for Rule 488 INFO Connection Closed MSG from Port 80, Brian
RE: rules for physical intruders, Steve Wray

December 13, 2003

Documentation for Rule 488 INFO Connection Closed MSG from Port 80, Joe Hdez
Documentation for Rule 448 ICMP Source Quench (Undefined Code!), Joe Hdez
windows authentication signatures, Albers, Lucas

December 12, 2003

Re: Worm, Virus, and Trojan sigs?, Nigel Houghton
Worm, Virus, and Trojan sigs?, Dan Michitsch
Re: within syntax questions, Brian
within syntax questions, David Wilburn
rules for physical intruders, adam_peterson

December 11, 2003

Re: Sinit rule anyone?, Joe Stewart

December 10, 2003

Re: ignoring lots of hosts, Erick Mechler
ignoring lots of hosts, David Wilburn

December 09, 2003

Re: Sinit rule anyone?, Matt Kettler
Sinit rule anyone?, Meij, Ewout {PGIN~Kaiseraugst}

December 08, 2003

Re: To drop packets, Matt Kettler
To drop packets, Anna Patil
Re: OpenSSH // SSH detection rules?, Phillip G Deneault
Re: filtering with snortsam after more then one match, Matt Kettler
sid 1652, james
Re: sid 1653, james
OpenSSH // SSH detection rules?, Tony Hernandez
filtering with snortsam after more then one match, Alexandru Balan

December 07, 2003

Re: SID 1042 false positives: WEB-IIS view source via translate header, Jason Haar

December 06, 2003

snort-rules CURRENT update @ Fri Dec 5 20:15:20 2003, bmc

December 05, 2003

snort-rules CURRENT update @ Fri Dec 5 13:15:18 2003, bmc
Re: SID 1042 false positives: WEB-IIS view source via translate header, Brian
SID 1042 false positives: WEB-IIS view source via translate header, Bradberry, John

December 04, 2003

Re: snort-rules STABLE update @ Mon Dec 1 13:15:17 2003, Frank Knobbe

December 03, 2003

Direct Connect, chuck
Re: False positive condition for SID 1141, Nigel Houghton
False positive condition for SID 1141, S Tonnesen
Just one rule to block the traffic, FDCServers Support
Re: from_client == to_server ?, Dirk Geschke
snort-sid-template for Rule 628, Joey Hdez
AW: Rule order question, Sean Wheeler
Rule order question, David Calder
RE: Searching for the latest Snort rules, JP Vossen
snort-rules CURRENT update @ Tue Dec 2 19:15:20 2003, bmc

December 02, 2003

Re: Documentation rule 884, Nigel Houghton
Documentation rule 884, Kevin Binsfield
Re: email spammer sigs?, Matt Kettler
email spammer sigs?, Tony Hernandez
RE: email spammer sigs?, Adrian Marsden
Re: email spammer sigs?, Jason Haar
Re: email spammer sigs?, James Riden
RE: OT: Finding Spam Trojans on your network (was Re: email spammer sigs?), Tony Hernandez
OT: Finding Spam Trojans on your network (was Re: email spammer sigs?), Brian Eckman
RE: email spammer sigs?, Raj Wurttemberg
Re: email spammer sigs?, Matt Kettler

December 01, 2003

Re: [Snort-sigs] PCRE Rules and hexa, Jeremy Hewlett
Re: some rules missing from sig-msg.map, Brian
Re: Documentation for Rule 628 SCAN nmap TCP, Nigel Houghton
Ignoring hosts, modular, Ralph M. Los
Documentation for Rule 628 SCAN nmap TCP, Joe Hdez
snort-rules STABLE update @ Mon Dec 1 13:15:17 2003, bmc
snort-rules CURRENT update @ Mon Dec 1 13:15:17 2003, bmc