security.ids.snort.sigs (thread)

false positive report: SID 2517, Lorrin Nelson
suggested changes to rule 2229, Rainer
SID 480 - False Positive, Firth, Matt
Snort signatures for PBX, Teicher, Mark
- Re: Snort signatures for PBX, Matt Jonkman
- Re: Snort signatures for PBX, Frank Knobbe
SID 2570, James Affeld
Additional False Positives for rule 1:498, Coral J. Cook
- Re: Additional False Positives for rule 1:498, Nigel Houghton
Possible False Positive, Brian Noel
- Re: Possible False Positive, Nigel Houghton
IIS NNTP Service XPAT Command Vulnerabilities Proof-of-Concept, Larry Wichman
Re: new Q signature, Kirby Angell
ARP "Who has (one address)" > "Tell (many different, random IP's)", Les Yaw
- Re: ARP "Who has (one address)" > "Tell (many different, random IP's)", Matt Kettler
- ARP "Who has (one address)" > "Tell (many different, random IP's)", Les Yaw
  - Re: ARP "Who has (one address)" > "Tell (many different, random IP's)", Paul Schmehl
- RE: ARP "Who has (one address)" > "Tell (many different, random IP's)", Williams Jon
- RE: ARP "Who has (one address)" > "Tell (many different, random IP's)", hchemin
False Positive with SID 2329 "MS-SQL probe response overflow attempt", Joerg Weber
Identical rules, Esler, Joel - Contractor
False positive alert: sid:2570, Michael Schwartzkopff
- RE: False positive alert: sid:2570, M. Shirk
  - Re: False positive alert: sid:2570, Brian
  - RE: False positive alert: sid:2570, nnposter
False positive in 2650.2 (ORACLE user name buffer overflow attempt), nnposter
- Re: False positive in 2650.2 (ORACLE user name buffer overflow attempt), Brian caswell
David Kibilka/Networking/Willich/Datasystems ist außer Haus., dkibilka
- David Kibilka/Networking/Willich/Datasystems ist außer Haus., dkibilka
Arachnids IDS181 and interesting false positive, James Lay
Rules utilisation, Chich Thierry
- Re: Rules utilisation, Matt Jonkman
  - Re: Rules utilisation, Byron Copeland
    - Re: Rules utilisation, Matt Jonkman
    - Re: Rules utilisation, Jason
- Malware zero day thingy, Brian Howard
  - Re: Malware zero day thingy, James Riden
Broken thresholding in 2923.1 and 2924.1?, nnposter
- Re: Broken thresholding in 2923.1 and 2924.1?, Judy Novak
  - Re: Broken thresholding in 2923.1 and 2924.1?, nnposter
    - Re: Broken thresholding in 2923.1 and 2924.1?, Judy Novak
RE: FP for NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt: sid, M. Shirk
RE: EXPLOIT SSLv2 Client_Hello with pad Challenge Length overflow a, M. Shirk
EXPLOIT SSLv2 Client_Hello with pad Challenge Length overflow attempt: sid 2657, Russell Fulton
FP for NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt: sid 2383 -- the real one, Russell Fulton
FP for NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt: sid 2383, Russell Fulton
- Re: FP for NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt: sid 2383, Jason
reporting false positives..., Russell Fulton
- Re: reporting false positives..., Matt Jonkman
  - Re: reporting false positives..., Jason
  - Re: reporting false positives..., Russell Fulton
    - Re: reporting false positives..., Matt Jonkman
    - Re: reporting false positives..., Jason
    - Re: reporting false positives..., Matthew Watchinski
(no subject), reynald
- RE: (no subject), Harper, Patrick
- RE: (no subject), Adrian Marsden
  - Re: (no subject), Les Yaw
[Plugins-writers] New Spyware Project with Nessus and BleedingSnort!!!, Matt Jonkman
RE: Signature Proposal, Esler, Joel - Contractor
- Signature Proposal, Holger Heimann
Colin Slevin/TRANSWARE/IE is out of the office., Colin . Slevin
- Re: Colin Slevin/TRANSWARE/IE is out of the office., Matt Kettler
  - Re: Colin Slevin/TRANSWARE/IE is out of the office., Jeff Nathan
    - Re: Colin Slevin/TRANSWARE/IE is out of the office., Matt Kettler
- Colin Slevin/TRANSWARE/IE is out of the office., Colin . Slevin
Sid Questions, Rowland, Krisa W ERDC-ITL-MS Contractor
- Re: Sid Questions, Matt Jonkman
- Re: Sid Questions, Erik de Castro Lopo
Bleeding-Edge Porn, Rowland, Krisa W ERDC-ITL-MS Contractor
- Re: Bleeding-Edge Porn, Matt Jonkman
- Re: Bleeding-Edge Porn, Matt Jonkman
RE: snort software: BASE SUGGESTION, Esler, Joel - Contractor
- RE: snort software: BASE SUGGESTION, Jose Maria Lopez
false positive on 1:469 ICMP PING NMAP, Chris Connell
- Re: false positive on 1:469 ICMP PING NMAP, Nigel Houghton
  - Re: false positive on 1:469 ICMP PING NMAP, Jose Maria Lopez
WEB-MISC SSLv3 invalid Client_Hello attempt, Vladimir Stavrinov
- Re: WEB-MISC SSLv3 invalid Client_Hello attempt, Brian
  - Re: WEB-MISC SSLv3 invalid Client_Hello attempt, Vladimir Stavrinov
- Re: WEB-MISC SSLv3 invalid Client_Hello attempt, M. Shirk
False Positive, Koelewijn, Bert
- Re: False Positive, Matt Kettler
  - Re: False Positive, Mark Buchanan
    - Re: False Positive, nnposter
    - Re: False Positive, Matt Kettler
    - Re: False Positive, Matt Kettler
  - Re: False Positive, nnposter
    - Re: False Positive, Matt Kettler
Signature false positive update #2590, Smargiassi William
- Re: Signature false positive update #2590, Brian
  - Re: Signature false positive update #2590, stephane nasdrovisky
snort software, Naveen Kumar Akkugari
- Re: snort software, twebster
- Re: snort software, Jose Maria Lopez
- RE: snort software, Truax, Shawn (MBS)
- RE: snort software, Harper, Patrick
- RE: snort software, Naveen Kumar Akkugari
  - RE: snort software, twebster
About GT-Bot signature, wei0930.tw
- Re: About GT-Bot signature, Matt Jonkman
ZSH Exploit False Positive, Stu Gott
- Re: ZSH Exploit False Positive, Nigel Houghton
- Re: ZSH Exploit False Positive, Brian
signature of win32 parite.a, gbd
Additional false positive for 1:1882 and 1:1292, Burtoft, Jim
- Re: Additional false positive for 1:1882 and 1:1292, Nigel Houghton
- Re: Additional false positive for 1:1882 and 1:1292, Brian
RE: CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Esler, Joel - Contractor
PCRE Editors/Debuggers [Slightly OT], JP Vossen
- Re: PCRE Editors/Debuggers [Slightly OT], Alex Butcher, ISC/ISYS
NNTP XPAT overflow attempt (CAN-2004-0574), nnposter
- Re: NNTP XPAT overflow attempt (CAN-2004-0574), Matt Jonkman
  - Re: NNTP XPAT overflow attempt (CAN-2004-0574), Matt Jonkman
  - Re: NNTP XPAT overflow attempt (CAN-2004-0574), Jason
- Re: NNTP XPAT overflow attempt (CAN-2004-0574), nnposter
- Re: NNTP XPAT overflow attempt (CAN-2004-0574), Brian
  - Re: NNTP XPAT overflow attempt (CAN-2004-0574), nnposter
RE: [Snort-users] Re: CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Esler, Joel - Contractor
RE: Re: CAUTION: Long Rant!!! Re: [Snort-sigs] Brok en 1429.2 (POLICY poll.gotomypc.c, Botwick, Jason (Genworth, Contractor)
RE: [SPAM] - Re: Rules for catching kiddy porn surfers - Found word(s) porn in the subject - Found word(s) porn in the subject, Kalbfleisch, Gary
RE: [SPAM] - Re: Rules for catching kiddy porn surfers - Found word(s) porn in the subject, Kalbfleisch, Gary
- Re: [SPAM] - Re: Rules for catching kiddy porn surfers - Found word(s) porn in the subject, Brian
Re: Rules for catching kiddy porn surfers - Found word(s) porn in the subject, Kalbfleisch, Gary
- Re: Rules for catching kiddy porn surfers - Found word(s) porn in the subject, Matt Jonkman
  - Re: Rules for catching kiddy porn surfers - Found word(s) porn in the subject, Jason
Re: CAUTION: Long Rant!!! Re: [Snort-sigs] Broken 1429.2 (POLICY poll.gotomypc.c, M. Shirk
- RE: Re: CAUTION: Long Rant!!! Re: [Snort-sigs] Broken 1429.2 (POLICY poll.gotomypc.c, Patrick S. Harper
  - Re: [Snort-users] Re: CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.c, Jason
- RE: CAUTION: Long Rant!!! Re: [Snort-sigs] Broken 1429.2 (POLICY poll.gotomypc.c, Esler, Joel - Contractor
- RE: Re: CAUTION: Long Rant!!! Re: [Snort-sigs] Broken 1429.2 (POLICY poll.gotomypc.c, Harper, Patrick
Rules for catching kiddy porn surfers, Kalbfleisch, Gary
- RE: Rules for catching kiddy porn surfers, Eric Hines
- Re: Rules for catching kiddy porn surfers, Matt Jonkman
  - Re: Rules for catching kiddy porn surfers, Erick Mechler
    - Re: Rules for catching kiddy porn surfers, twebster
    - MUA: Lotus Notes (was Re: Rules for catching kiddy porn surfers), Chris Green
    - Re: Rules for catching kiddy porn surfers, Matt Jonkman
    - Re: Rules for catching kiddy porn surfers, nnposter
    - Re: Rules for catching kiddy porn surfers, Jose Maria Lopez
Broken 1429.2 (POLICY poll.gotomypc.com access), nnposter
- Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Matt Jonkman
  - Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Matt Jonkman
    - Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Brian
    - CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Matt Jonkman
    - Re: CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Brian
    - Re: CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Matt Jonkman
    - RE: CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Eric Hines
    - Re: CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Bamm Visscher
    - Re: CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Matt Jonkman
    - Re: CAUTION: Long Rant!!! Re: [Snort-sigs] Broken 1429.2 (POLICY poll.gotomypc.com access), Bamm Visscher
    - Re: CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Matt Jonkman
    - Thresholds on Policy Rules, Matt Jonkman
    - Re: Thresholds on Policy Rules, Brian
    - Re: Thresholds on Policy Rules, Matt Jonkman
    - Re: Thresholds on Policy Rules, Jason
    - Re: Thresholds on Policy Rules, Matt Jonkman
    - Re: Thresholds on Policy Rules, Jason
    - Re: Thresholds on Policy Rules, Matt Jonkman
    - Re: Thresholds on Policy Rules, James Riden
    - Re: Thresholds on Policy Rules, Frank Knobbe
    - Re: CAUTION: Long Rant!!! Re: Broken 1429.2 (POLICY poll.gotomypc.com access), Paul Schmehl
Classtype accuracy?, nnposter
- Re: Classtype accuracy?, Matthew Watchinski
  - Re: Classtype accuracy?, nnposter
ASP.net Auth Bypass Vulnerability, Matt Jonkman
- Re: ASP.net Auth Bypass Vulnerability, sekure
  - Re: ASP.net Auth Bypass Vulnerability, Matt Jonkman
    - Re: ASP.net Auth Bypass Vulnerability, sam
    - Re: ASP.net Auth Bypass Vulnerability, Matt Jonkman
false positives with SID 1549, Chris Kronberg
- RE: false positives with SID 1549, nnposter
False positives on 1360.5 et al., nnposter
Broken 1329.6 (WEB-ATTACKS ps command attempt), nnposter
portscan rule, Benjamin J Paradis
- Re: portscan rule, James Riden
- RE: portscan rule, Adrian Marsden
grupo de snort en espa�ol, CAPRA, Claudio Alberto
reg Snort ruleupdate, Mayank Bhatnagar
can any one help me ?, Suresh Kolsur
- Re: can any one help me ?, Jose Maria Lopez
- RE: can any one help me ?, Harper, Patrick
New Bleedingsnort.com Website, Matt Jonkman
GDI+ Signatures, Rick Salsa
New Oinkmaster/Bleedingsnort Guide, Matt Jonkman
Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- RE: Bleedingsnort.com Daily Update, Esler, Joel - Contractor
- RE: Bleedingsnort.com Daily Update, Adrian Marsden
  - Re: Bleedingsnort.com Daily Update, Matt Jonkman
  - Re: Bleedingsnort.com Daily Update, Matt Jonkman
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt