Snort: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

2504 messages starting Mar 31 02 and ending Jun 30 02
Date index | Thread index | Author index

• Logging to Remote syslog server Terry Magee (Mar 31)
  • Re: Logging to Remote syslog server Rich Adamson (Mar 31)
  • <Possible follow-ups>
  • RE: Logging to Remote syslog server Madziarczyk, Jonathan (Mar 31)
• Re: No alerts Chris Green (Mar 31)
• icmp: is this real? John Sage (Mar 31)
  • Re: icmp: is this real? Chris Green (Mar 31)
    • Re: icmp: is this real? John Sage (Mar 31)
      • Re: icmp: is this real? Erek Adams (Mar 31)
      • Re: icmp: is this real? John Sage (Apr 01)
      • Re: icmp: is this real? Erek Adams (Apr 01)
      • Re: icmp: is this real? John Sage (Apr 01)
      • Re: icmp: is this real? Chris Green (Apr 01)
• RE: Rules Errors Turner Ryan S CONT KPWA (Mar 31)
  • Re: Rules Errors Mike Macias (Apr 03)
• snort does not log data lakshmi ramachandran (Mar 31)
  • Re: snort does not log data Chris Green (Apr 01)
• BUG in stream4 reassemble Peng Yong (Apr 01)
  • Re: BUG in stream4 reassemble Chris Green (Apr 01)
  • <Possible follow-ups>
  • BUG in stream4 reassemble Peng Yong (Apr 02)
    • Re: BUG in stream4 reassemble Chris Green (Apr 02)
• Snort fails to log data janaki ramachandran (Apr 01)
• Re: Snot attacks and -z est option - regarding FAQ 1.9 counter . spy (Apr 01)
  • <Possible follow-ups>
  • Re: Snot attacks and -z est option - regarding FAQ 1.9 counter . spy (Apr 01)
  • Re: Snot attacks and -z est option - regarding FAQ 1.9 Chris Green (Apr 02)
• SYN Flood preprocessor? Sheahan, Paul (PCLN-NW) (Apr 01)
• IDS Policy Manager 1.2 Release jdell (Apr 01)
  • <Possible follow-ups>
  • Re: IDS Policy Manager 1.2 Release Mike_Sands (Apr 01)
• Snarf will not DNS james (Apr 01)
  • <Possible follow-ups>
  • Snarf will not DNS james (Apr 02)
    • Re: Snarf will not DNS James Hoagland (Apr 02)
• Spade Joint Prob table output Wilson Farrell (Apr 01)
  • Re: Spade Joint Prob table output James Hoagland (Apr 02)
    • Re: Spade Joint Prob table output Wilson Farrell (Apr 02)
• double post of Re: Snot attacks... counter . spy (Apr 01)
• portscan log Jason Yates (Apr 01)
  • Re: portscan log Erek Adams (Apr 01)
• nmap scans don't appear in portscan.log Salomon, Charlie (Apr 01)
  • Re: nmap scans don't appear in portscan.log Erek Adams (Apr 01)
  • <Possible follow-ups>
  • Re: nmap scans don't appear in portscan.log Jason Yates (Apr 01)
  • RE: nmap scans don't appear in portscan.log Estes, Matt: CPR / FCBS (Apr 02)
  • RE: nmap scans don't appear in portscan.log Fallon, Benjamin (Apr 02)
• spp_portscan and ACID Jason Yates (Apr 01)
  • <Possible follow-ups>
  • RE: spp_portscan and ACID Estes, Matt: CPR / FCBS (Apr 02)
  • spp_portscan and ACID Alwin Raymundo (Apr 04)
• stop that pesky logging Mike_Sands (Apr 01)
  • Re: stop that pesky logging Erek Adams (Apr 02)
• Time Activated Rules Madhav Diwan (Apr 01)
  • what's preferred kernel? Onie Camara (Apr 02)
    • Re: what's preferred kernel? Ralf Hildebrandt (Apr 02)
• Classtype Field for Win32 Rules Andrew Blevins (Apr 01)
  • Re: Classtype Field for Win32 Rules Dragos Ruiu (Apr 14)
• Re: Phil is coming out of the closet Jeff Nathan (Apr 02)
• Re: explicitly telling snort not to log to /var/log/snort Erik Melander (Apr 02)
• Re: Snort+flexresp Jeff Nathan (Apr 02)
  • Re: Snort+flexresp Onie Camara (Apr 02)
    • Re: Snort+flexresp Jeff Nathan (Apr 02)
      • Re: Snort+flexresp Anton A. Chuvakin (Apr 02)
      • Re: Snort+flexresp Onie Camara (Apr 02)
• Snort Working Mechanism Sonika Malhotra (Apr 02)
  • Re: Snort Working Mechanism Erek Adams (Apr 02)
    • Re: Snort Working Mechanism Sonika Malhotra (Apr 03)
      • Re: Snort Working Mechanism Phil Wood (Apr 03)
      • Re: Snort Working Mechanism Erek Adams (Apr 03)
    • Re: Snort Working Mechanism Sonika Malhotra (Apr 03)
  • <Possible follow-ups>
  • Re: Snort Working Mechanism Scott Nursten (Apr 02)
• problem logging to mysql database Omolayo Salako (Apr 02)
  • <Possible follow-ups>
  • Re: problem logging to mysql database Mike_Sands (Apr 02)
• AW: problem logging to mysql database Poppi, Sandro (Apr 02)
• Problem running Snort on WinXP Grzegorz Flak (Apr 02)
• Snort, Acid, BigBrother Martin C. Walker (Apr 02)
• Re: Snort on WinXP: driver problem Dragos Ruiu (Apr 02)
  • RE: Snort on WinXP: driver problem Naor (Apr 02)
• Re: Libpcap library/headers not found... Haubein, Ted (Apr 02)
  • Re: Libpcap library/headers not found... Richard Powell (Apr 10)
• Re: acid question Michael Scheidell (Apr 02)
  • <Possible follow-ups>
  • ACID question Raymond Jacob (Apr 05)
• pcap_loop: bogus savefile header Vincent Chen (Apr 02)
• New to Snort Whaley, Mike (Apr 02)
• how to upgrade to schema 105? Michael Scheidell (Apr 02)
  • <Possible follow-ups>
  • RE: how to upgrade to schema 105? Kreimendahl, Chad J (Apr 02)
• Re: Windows Warning Chris Green (Apr 02)
• Re: tcpdump and snort report 2 different TTL values Chris Green (Apr 02)
• Re: VAR and IP lists Chris Green (Apr 02)
  • <Possible follow-ups>
  • RE: VAR and IP lists Estes, Matt: CPR / FCBS (Apr 02)
• Demarc database schema issue Gavin O'Connor (Apr 02)
  • Re: Demarc database schema issue Shawn Duffy (Apr 02)
  • <Possible follow-ups>
  • Demarc database schema issue Gavin O'Connor (Apr 14)
    • RE: Demarc database schema issue Scott Stokes (Apr 14)
• Re: rule processing. Chris Green (Apr 02)
  • Ri: Re: rule processing. Federico (Apr 01)
• Re: Rules under SNORT_1_8 cvs tag? Chris Green (Apr 02)
• Snort and MS SQL reporting McConnon, John (Apr 02)
• RE: Xp and Snort Grzegorz Flak (Apr 02)
• Re: How To Decode IPv6 Packet? Matt Watchinski (Apr 02)
• ./configure --with-mysql= ? John Sage (Apr 02)
  • Re: ./configure --with-mysql= ? Chris Green (Apr 02)
    • Re: ./configure --with-mysql= ? John Sage (Apr 02)
    • Re: ./configure --with-mysql= ? John Sage (Apr 02)
  • <Possible follow-ups>
  • RE: ./configure --with-mysql= ? Ronneil Camara (Apr 02)
• configure --with-mysql= ? John Sage (Apr 02)
  • Re: configure --with-mysql= ? ___cliff rayman___ (Apr 02)
    • Re: configure --with-mysql= ? Jason Yates (Apr 02)
• FW: snortdb schema update Dan Fiorito (Apr 02)
• Database event sorting Estes, Matt: CPR / FCBS (Apr 02)
• OT: Deciphering log entry(iptables) Scott Taylor (Apr 02)
  • Re: OT: Deciphering log entry(iptables) Matt Kettler (Apr 02)
    • Re: OT: Deciphering log entry(iptables) Chris Green (Apr 02)
• RE: OT what's preferred kernel? Ryan Hill (Apr 02)
• Snort Solaris 8 with quad card Chris Frazier - PA (Apr 02)
  • Re: Snort Solaris 8 with quad card Erek Adams (Apr 02)
    • Re: Snort Solaris 8 with quad card Scott Nursten (Apr 02)
      • RE: Snort Solaris 8 with quad card Jason Lewis (Apr 02)
  • <Possible follow-ups>
  • RE: Snort Solaris 8 with quad card Chris Frazier - PA (Apr 03)
• unsubscribe Francois Le Bec (Apr 02)
  • Re: unsubscribe Erek Adams (Apr 02)
  • <Possible follow-ups>
  • unsubscribe Martin Claesson (Apr 23)
  • unsubscribe Markt (Jun 03)
  • unsubscribe Taylor Lewick (Jun 11)
    • Re: unsubscribe Erek Adams (Jun 11)
  • unsubscribe Robbie Lee (Jun 18)
  • unsubscribe Mark Palmer, CCNA (Jun 29)
• linux kernel? Ronneil Camara (Apr 02)
  • Re: linux kernel? Ralf Hildebrandt (Apr 03)
• Force a server to send fragments? Sheahan, Paul (PCLN-NW) (Apr 02)
  • Re: Force a server to send fragments? Joe McAlerney (Apr 02)
• Anyone recognize this packet? Rich Adamson (Apr 03)
  • Anyone recognize this packet? David Bianco (Apr 03)
  • <Possible follow-ups>
  • RE: Anyone recognize this packet? Kjetil Laasby (Apr 03)
• AW: New to Snort Poppi, Sandro (Apr 03)
• Using Snort for Wireless Lists (Apr 03)
  • Re: Using Snort for Wireless Mike Craik (Apr 03)
  • Re: Using Snort for Wireless james (Apr 03)
  • Re: Using Snort for Wireless Skip Carter (Apr 03)
  • Re: Using Snort for Wireless Erek Adams (Apr 03)
  • Re: Using Snort for Wireless Aaron Richard Walters (Apr 04)
    • Re: Using Snort for Wireless Mike Craik (Apr 04)
    • Re: Using Snort for Wireless Nick Petroni (Apr 04)
    • what would be the appropriate thing to do? Onie Camara (Apr 04)
• snort current doesnt run Marcello Mezzanotti (Apr 03)
  • Re: snort current doesnt run Chris Green (Apr 03)
  • <Possible follow-ups>
  • RE: snort current doesnt run Estes, Matt CPR / FCBS (Apr 04)
• Is this a valid traffic? Onie Camara (Apr 03)
  • Re: Is this a valid traffic? Skip Carter (Apr 03)
    • Re: Is this a valid traffic? Joe Matusiewicz (Apr 03)
  • Re: Is this a valid traffic? Chris Green (Apr 03)
• archive snort logs? Devon Harding - GTHLA (Apr 03)
  • Re: archive snort logs? Ralf Hildebrandt (Apr 03)
    • Re: archive snort logs? james (Apr 04)
  • Re: archive snort logs? Skip Carter (Apr 04)
  • <Possible follow-ups>
  • RE: archive snort logs? Devon Harding - GTHLA (Apr 04)
• Snort rules update Rimas (Apr 03)
  • Re: Snort rules update Erek Adams (Apr 03)
  • <Possible follow-ups>
  • RE: Snort rules update Kreimendahl, Chad J (Apr 03)
• 1.8.5 ? Federico Lombardo (Apr 03)
  • Re: 1.8.5 ? Chris Green (Apr 03)
    • Re: 1.8.5 ? Onie Camara (Apr 03)
      • Re: 1.8.5 ? Chris Green (Apr 03)
      • Re: 1.8.5 mysql_error ___cliff rayman___ (Apr 03)
      • Re: 1.8.5 mysql_error ___cliff rayman___ (Apr 04)
  • Re: 1.8.5 ? Erek Adams (Apr 04)
• FrontPage Events Bradley, Paul (Apr 03)
  • Re: FrontPage Events Roelof JT Jonkman (Apr 04)
• Alert but NOT log? Sheahan, Paul (PCLN-NW) (Apr 03)
  • <Possible follow-ups>
  • RE: Alert but NOT log? Sheahan, Paul (PCLN-NW) (Apr 03)
    • Re: Alert but NOT log? james (Apr 04)
      • Re: Alert but NOT log? Erek Adams (Apr 04)
  • RE: Alert but NOT log? Sheahan, Paul (PCLN-NW) (Apr 05)
• mysql schema & multiple snort versions & sensors Phil Lyons (Apr 03)
  • Re: mysql schema & multiple snort versions & sensors Erek Adams (Apr 04)
  • RE: mysql schema & multiple snort versions & sensors Mike Arrison (Apr 04)
  • <Possible follow-ups>
  • Re: mysql schema & multiple snort versions & sensors Phil Lyons (Apr 03)
• Catbird sets off alerts Kevin L Pawloski (Apr 03)
• how to not to log Ronneil Camara (Apr 03)
• AW: snort activating my own script Poppi, Sandro (Apr 03)
• Snort Install--Win2K Whaley, Mike (Apr 03)
  • RE: Snort Install--Win2K Michael Steele (Apr 08)
• SPADE alerts, but doesn't log Nate S. (Apr 03)
  • <Possible follow-ups>
  • SPADE alerts, but doesn't log nate (Apr 14)
    • Re: SPADE alerts, but doesn't log Erek Adams (Apr 14)
• Setting specific filters on Snort. Ashley Thomas (Apr 04)
  • Re: Setting specific filters on Snort. Chris Green (Apr 04)
• Re: 1.8.5 mysql_error roman (Apr 04)
  • <Possible follow-ups>
  • RE: 1.8.5 mysql_error Steve Halligan (Apr 04)
• stop HTML post Petriz, Pablo (Apr 04)
  • SNMP EXCLUDE Ganu Skop (Apr 05)
    • Re: SNMP EXCLUDE Onie Camara (Apr 05)
• acid-archive-snortprob Ed Spick (Apr 04)
  • Re: acid-archive-snortprob ___cliff rayman___ (Apr 04)
• missing includes in large number of files Kreimendahl, Chad J (Apr 04)
  • Re: [Snort-devel] missing includes in large number of files Chris Green (Apr 04)
• content-list rule won't work Sheahan, Paul (PCLN-NW) (Apr 04)
  • <Possible follow-ups>
  • Re: content-list rule won't work Andreu . Gomez (Apr 05)
• no UDP Denis Romanov (Apr 04)
• Subliminal html in spam? John Sage (Apr 04)
  • Re: Subliminal html in spam? Dragos Ruiu (Apr 04)
  • Re: Subliminal html in spam? J. Craig Woods (Apr 04)
    • Re: Subliminal html in spam? John Sage (Apr 06)
  • Re: *****SPAM***** Subliminal html in spam? Shane Williams (Apr 06)
• AW: what would be the appropriate thing to do? Poppi, Sandro (Apr 04)
  • Re: what would be the appropriate thing to do? Onie Camara (Apr 04)
  • <Possible follow-ups>
  • AW: what would be the appropriate thing to do? Poppi, Sandro (Apr 04)
    • Re: what would be the appropriate thing to do? Onie Camara (Apr 04)
  • AW: what would be the appropriate thing to do? Poppi, Sandro (Apr 04)
    • maxsize of mysql db? Onie Camara (Apr 04)
      • Re: maxsize of mysql db? Chris Adams (Apr 14)
• whitehats.com is online again Poppi, Sandro (Apr 05)
  • Re: whitehats.com is online again Patrick Harper (Apr 05)
  • <Possible follow-ups>
  • RE: whitehats.com is online again Sean T. Ballard (Apr 05)
    • Re: whitehats.com is online again Patrick Harper (Apr 05)
• RE: SNMP EXCLUDE Kjetil Laasby (Apr 05)
• Disable spoofing ARP in kill packets Laurent Cabal (Apr 05)
  • Re: Disable spoofing ARP in kill packets Jeff Nathan (Apr 17)
• Some questions about snort Laurent Cabal (Apr 05)
  • Re: Some questions about snort Chris Green (Apr 05)
• recommendations !? Hilton De Meillon (Apr 05)
• up the snort ides Federico Rena (Apr 05)
  • <Possible follow-ups>
  • up the snort ides Federico Rena (Apr 05)
• Idea my snort database..!! kamesh_rajaram (Apr 05)
  • <Possible follow-ups>
  • RE: Idea my snort database..!! Steve Halligan (Apr 05)
• Re: Snort-users digest, Vol 1 #1760 - 15 msgs Denis Romanov (Apr 05)
• Re: Snort-users digest, Vol 1 #1762 - 13 msgs Denis Romanov (Apr 05)
• Snort 99% cpu utilization and no process activity Mike Ahern (Apr 05)
  • Re: Snort 99% cpu utilization and no process activity Andreas Östling (Apr 05)
  • <Possible follow-ups>
  • Snort 99% cpu utilization and no process activity Mike Ahern (Apr 14)
    • Re: Snort 99% cpu utilization and no process activity Erek Adams (Apr 14)
• test message -- ignore Chris Eidem (Apr 05)
• Snort and the Windows Family... Benoit Clarembeau (Apr 05)
  • Re: Snort and the Windows Family... Erek Adams (Apr 05)
  • <Possible follow-ups>
  • Re: Snort and the Windows Family... Benoit Clarembeau (Apr 05)
• what does this mean Omolayo Salako (Apr 05)
  • Re: what does this mean krista l merrill (Apr 05)
  • Re: what does this mean Ryan Russell (Apr 05)
  • Re: what does this mean Onie Camara (Apr 05)
  • <Possible follow-ups>
  • RE: what does this mean McCammon, Keith (Apr 05)
  • RE: what does this mean Andrew Blevins (Apr 05)
• TCP ******S* portscan Marcel Hauser (Apr 05)
  • Re: TCP ******S* portscan Matt Kettler (Apr 05)
    • Re: TCP ******S* portscan Hauser Marcel (Apr 05)
    • Message not available
      • Re: TCP ******S* portscan Matt Kettler (Apr 05)
      • Re: TCP ******S* portscan "SOLVED" Marcel Hauser (Apr 06)
  • Re: TCP ******S* portscan Ricardo SIGNES (Apr 05)
  • <Possible follow-ups>
  • RE: TCP ******S* portscan Andrew Blevins (Apr 05)
    • RE: TCP ******S* portscan Hauser Marcel (Apr 05)
    • RE: TCP ******S* portscan Marcel Hauser (Apr 05)
      • Re: TCP ******S* portscan Chris Keladis (Apr 05)
  • RE: TCP ******S* portscan Andrew Blevins (Apr 05)
• OT: RE: what does this mean Matt Kettler (Apr 05)
  • Re: OT: RE: what does this mean Phil Wood (Apr 05)
• update rules set automatically jianwen pi (Apr 05)
  • Re: update rules set automatically Erek Adams (Apr 05)
• Two content variables Kevin L Pawloski (Apr 05)
  • Re: Two content variables Erek Adams (Apr 05)
  • <Possible follow-ups>
  • Re: Two content variables Kevin L Pawloski (Apr 05)
    • Re: Two content variables Erek Adams (Apr 05)
• Portscanning from my network Steve Ochani (Apr 05)
  • what would be the effect? Onie Camara (Apr 05)
  • <Possible follow-ups>
  • RE: Portscanning from my network Sheahan, Paul (PCLN-NW) (Apr 08)
  • RE: Portscanning from my network Ryan Hill (Apr 08)
  • Portscanning from my network Steve Ochani (Apr 14)
• AW: Some questions about snort Poppi, Sandro (Apr 05)
• AW: whitehats.com is online again Poppi, Sandro (Apr 05)
  • Re: whitehats.com is online again John Sage (Apr 06)
• SNORT USAGE Brian (Automail) (Apr 06)
  • <Possible follow-ups>
  • SNORT USAGE Brian (Automail) (Apr 13)
  • SNORT USAGE Brian (Automail) (May 04)
  • SNORT USAGE Brian (Automail) (May 11)
  • SNORT USAGE Brian (Automail) (May 18)
  • SNORT USAGE Brian (Automail) (May 25)
    • SNORT rule Mr. F Phat's (May 27)
      • RE: SNORT rule John Stroud (May 27)
  • SNORT USAGE Brian (Automail) (Jun 01)
  • SNORT USAGE Brian (Automail) (Jun 08)
  • SNORT USAGE Brian (Automail) (Jun 15)
  • SNORT USAGE Brian (Automail) (Jun 22)
  • SNORT USAGE Brian (Automail) (Jun 29)
• SNORT FAQ Brian (Automail) (Apr 06)
  • <Possible follow-ups>
  • SNORT FAQ Brian (Automail) (Apr 13)
  • SNORT FAQ Brian (Automail) (May 04)
  • SNORT FAQ Brian (Automail) (May 11)
  • SNORT FAQ Brian (Automail) (May 18)
  • SNORT FAQ Brian (Automail) (May 25)
  • SNORT FAQ Brian (Automail) (Jun 01)
  • SNORT FAQ Brian (Automail) (Jun 08)
  • SNORT FAQ Brian (Automail) (Jun 15)
  • SNORT FAQ Brian (Automail) (Jun 22)
  • SNORT FAQ Brian (Automail) (Jun 29)
• Problem with Demarc Andrea (Apr 06)
• Snort Rule Id (sid) Daniel J Camero (Apr 06)
• session log Peng Yong (Apr 07)
  • Re: session log Chris Green (Apr 08)
• Anomalous packet logged by Snort Bill McCarty (Apr 07)
  • Re: Anomalous packet logged by Snort Chris Green (Apr 08)
  • Re: Anomalous packet logged by Snort Dan Hawrylkiw (Apr 14)
    • Re: Anomalous packet logged by Snort Bill McCarty (Apr 07)
      • Re: Anomalous packet logged by Snort Chris Green (Apr 08)
  • <Possible follow-ups>
  • RE: Anomalous packet logged by Snort Hawrylkiw, Dan G (Apr 08)
    • Re: Anomalous packet logged by Snort Chris Green (Apr 08)
  • RE: Anomalous packet logged by Snort Safka (Apr 14)
• idmef on FreeBSD Rob Hughes (Apr 07)
  • Re: idmef on FreeBSD Joe McAlerney (Apr 08)
• ACID: sort order for email "alerts full" John Sage (Apr 07)
• Todays checkout fails miserably... Ralf Hildebrandt (Apr 08)
  • Re: Todays checkout fails miserably... Chris Green (Apr 08)
• How does one print out summary of unique addresses. Raymond Jacob (Apr 08)
• Flexresp Alwin Raymundo (Apr 08)
  • Re: Flexresp Phil Wood (Apr 08)
    • Re: Flexresp Alwin Raymundo (Apr 08)
      • Re: Flexresp Phil Wood (Apr 08)
  • <Possible follow-ups>
  • RE: Flexresp Ronneil Camara (Apr 08)
    • RE: Flexresp Alwin Raymundo (Apr 08)
  • RE: Flexresp Ronneil Camara (Apr 08)
  • Re: Flexresp counter . spy (Apr 08)
  • RE: Flexresp Sheahan, Paul (PCLN-NW) (Apr 08)
    • RE: Flexresp Alwin Raymundo (Apr 09)
  • RE: Flexresp Ronneil Camara (Apr 08)
  • Re: Flexresp Alwin Raymundo (Apr 09)
• private IP scans White, Stacy (Apr 08)
  • <Possible follow-ups>
  • RE: private IP scans Sheahan, Paul (PCLN-NW) (Apr 08)
  • RE: private IP scans McCammon, Keith (Apr 08)
• Snort and Logwatch Shane Hickey (Apr 08)
  • Re: Snort and Logwatch Ed Kasky (Apr 08)
• Snort 1.8.6 is Available! Chris Green (Apr 08)
  • <Possible follow-ups>
  • RE: Snort 1.8.6 is Available! Ronneil Camara (Apr 08)
• AW: Snort and Logwatch Poppi, Sandro (Apr 08)
• Firewall Tester 0.6 Andrea Barisani (Apr 09)
  • Re: Firewall Tester 0.6 Jim Geovedi (Apr 09)
• where can i find out the meaning Fuchs Bernhard (Apr 09)
  • Snort 1.8.6 RPMS? Lou Spironello (Apr 09)
    • Re: Snort 1.8.6 RPMS? Chris Green (Apr 09)
      • Re: Snort 1.8.6 RPMS? Lou Spironello (Apr 09)
      • Re: Snort 1.8.6 RPMS? Lou Spironello (Apr 11)
• Help-me Carlos Augusto Silva (Apr 09)
  • Re: Help-me Chris Green (Apr 09)
    • Re: Help-me Carlos Augusto Silva (Apr 09)
    • Re: Help-me Carlos Augusto Silva (Apr 09)
• Re: what would be the effect? Andreu . Gomez (Apr 09)
• missing declaration makes 1.8.6 to segfault Federico Lombardo (Apr 09)
  • Re: missing declaration makes 1.8.6 to segfault Chris Green (Apr 09)
  • Re: missing declaration makes 1.8.6 to segfault Andrew R. Baker (Apr 14)
• Sql syntax error logging to mysql Ian Macdonald (Apr 09)
• Other Snort rulesets? krista l merrill (Apr 09)
  • Re: Other Snort rulesets? Chris Green (Apr 09)
• Snort ERROR on Kernel Carlos Augusto Silva (Apr 09)
  • <Possible follow-ups>
  • RE: Snort ERROR on Kernel Wirth, Jeff (Apr 09)
  • Snort error on kernel Carlos Augusto Silva (Apr 09)
• (no subject) Federico Rena (Apr 09)
  • Re: (no subject) Matt Kettler (Apr 09)
  • <Possible follow-ups>
  • (no subject) Federico Rena (Apr 10)
  • (no subject) Federico Rena (Apr 10)
    • Re: (no subject) John Sage (Apr 10)
  • (no subject) Federico Rena (Apr 10)
  • RE: (no subject) Omolayo Salako (Apr 10)
  • (no subject) rakesh (Apr 11)
  • (no subject) Ha Hoang (Apr 13)
  • (no subject) Chris Eidem (Apr 14)
    • Re: (no subject) Erek Adams (Apr 14)
  • RE: (no subject) Chris Eidem (Apr 15)
    • RE: Syslog Coughs? Erek Adams (Apr 15)
  • (no subject) C Boss (Apr 25)
    • Re: (no subject) Ralf Hildebrandt (Apr 25)
  • (no subject) Zero Dark (May 04)
    • Re: (no subject) Matt Kettler (May 04)
  • (no subject) Vadim Pushkin (May 07)
  • (no subject) Z . Qili (May 07)
  • (no subject) John Maestrale (May 20)
  • (no subject) John Maestrale (May 29)
  • (no subject) Hugo Ferr (May 31)
    • Re: (no subject) Rich Adamson (May 31)
    • RE: (no subject) John Stroud (May 31)
  • RE: (no subject) Wirth, Jeff (May 31)
    • Re: (no subject) Hugo Ferr (May 31)
  • (no subject) Eduard San Anselmo (Jun 04)
  • RE: (no subject) McCammon, Keith (Jun 04)
  • FW: (no subject) ChandlerH (Jun 04)
  • RE: (no subject) Richard Silver (Jun 04)
  • (no subject) john (Jun 11)
  • (no subject) Richard Houston (Jun 12)
    • Re: (no subject) Erek Adams (Jun 12)
• upgrading from 1.8.4 to 1.8.6 Tony Wong (Apr 09)
  • Re: upgrading from 1.8.4 to 1.8.6 Ryan Russell (Apr 09)
• Re: where can i find out the meaning (stealth nop) Matt Kettler (Apr 09)
• ICMP Destination Unreachable Tony Wong (Apr 09)
  • Re: ICMP Destination Unreachable Matt Kettler (Apr 09)
  • <Possible follow-ups>
  • RE: ICMP Destination Unreachable Wirth, Jeff (Apr 09)
• SMTP rule needed Paul . Simons (Apr 09)
  • Re: SMTP rule needed Matt Kettler (Apr 09)
  • <Possible follow-ups>
  • Re: SMTP rule needed Paul . Simons (Apr 09)
  • Re: SMTP rule needed Andreu . Gomez (Apr 10)
  • RE: SMTP rule needed Wirth, Jeff (Apr 10)
• I can't logging data : My snort.conf Dino Macedo Amaral (Apr 09)
• Snort on HP-UX Taylor Lewick (Apr 09)
  • Re: Snort on HP-UX Chris Green (Apr 09)
  • Re: Snort on HP-UX Ralf Hildebrandt (Apr 10)
  • <Possible follow-ups>
  • Re: Snort on HP-UX Taylor Lewick (Apr 10)
    • Re: Snort on HP-UX Chris Green (Apr 10)
  • Re: Snort on HP-UX Taylor Lewick (Apr 11)
    • Re: Snort on HP-UX Chris Green (Apr 11)
• Need help with a rule Sheahan, Paul (PCLN-NW) (Apr 09)
  • Re: Need help with a rule Ryan Russell (Apr 09)
  • <Possible follow-ups>
  • RE: Need help with a rule Sheahan, Paul (PCLN-NW) (Apr 09)
    • RE: Need help with a rule Ryan Russell (Apr 09)
    • Re: Need help with a rule Andreas Östling (Apr 10)
  • RE: Need help with a rule Estes, Matt CPR / FCBS (Apr 10)
• Error opening adapter... Thomas Schweikle (Apr 09)
  • Re: Error opening adapter... secsnort (Apr 09)
  • <Possible follow-ups>
  • Re: Error opening adapter... Thomas Schweikle (Apr 10)
• snort on IP-less interface mel (Apr 09)
• AW: snort on IP-less interface Poppi, Sandro (Apr 09)
  • Re: snort on IP-less interface 'mel' (Apr 10)
• not really off topic Fuchs Bernhard (Apr 10)
  • <Possible follow-ups>
  • RE: not really off topic counter . spy (Apr 11)
    • Re: not really off topic Tom Fischer (Apr 11)
• Patch for bug in Acid criteria removal Mark Vevers (Apr 10)
  • <Possible follow-ups>
  • Re: Patch for bug in Acid criteria removal roman (Apr 11)
• Unable to start snort version 1.8.6 in Daemon mode rakesh (Apr 10)
  • Re: Unable to start snort version 1.8.6 in Daemon mode Brian (Apr 10)
    • simple reporter Onie Camara (Apr 10)
• Snort-1.8.6 on SuSE-7.2 selfmade pcap-0.7.1 dies in 'content list' ?! Chr. v. Stuckrad (Apr 10)
• Stealth Packets Ok? Estes, Matt CPR / FCBS (Apr 10)
• need help asap noorulsadiqin azbiya (Apr 10)
• Re: bad priority messages Chr. v. Stuckrad (Apr 10)
• Snort error on kernel - please helpme Carlos Augusto Silva (Apr 10)
• How do I ignore portscans from everything but HOME_NET? Steve Ochani (Apr 10)
• Thoughts on internal vs. external IDS rulesets Chris Eidem (Apr 10)
  • Re: Thoughts on internal vs. external IDS rulesets Steve Ochani (Apr 10)
  • <Possible follow-ups>
  • RE: Thoughts on internal vs. external IDS rulesets Chris Eidem (Apr 10)
  • RE: Thoughts on internal vs. external IDS rulesets Sheahan, Paul (PCLN-NW) (Apr 10)
    • RE: Thoughts on internal vs. external IDS rulesets Alwin Raymundo (Apr 11)
  • RE: Thoughts on internal vs. external IDS rulesets Sheahan, Paul (PCLN-NW) (Apr 11)
• Placement of Snort IDS Kenny D (Apr 10)
  • <Possible follow-ups>
  • RE: Placement of Snort IDS Sheahan, Paul (PCLN-NW) (Apr 10)
    • Gigabit snort? Michael Cunningham (Apr 10)
      • Re: Gigabit snort? Frank Knobbe (Apr 13)
      • Re: Gigabit snort? Jeff Nathan (Apr 17)
  • Placement of Snort IDS Kenny D (Apr 14)
    • Re: Placement of Snort IDS Erek Adams (Apr 14)
• RE: How do I ignore portscans from everything but H OME_NET? Slighter, Tim (Apr 10)
  • RE: How do I ignore portscans from everything but HOME_NET? Steve Ochani (Apr 10)
    • RE: How do I ignore portscans from everything but HOME_NET? Steve Ochani (Apr 10)
      • RE: How do I ignore portscans from everything but HOME_NET? Erek Adams (Apr 10)
• Problem with a rule Tom Fischer (Apr 10)
  • Re: Problem with a rule Andreas Östling (Apr 10)
• Libpcap library/headers not found and bigendian ? Daniel Curry (Apr 10)
  • <Possible follow-ups>
  • Libpcap library/headers not found and bigendian ? Daniel Curry (Apr 14)
    • Re: Libpcap library/headers not found and bigendian ? Erek Adams (Apr 14)
      • Re: Libpcap library/headers not found and bigendian? Daniel Curry (Apr 15)
      • Re: Libpcap library/headers not found and bigendian? Daniel Curry (Apr 15)
      • Re: Libpcap library/headers not found and bigendian? Erek Adams (Apr 15)
      • Re: Libpcap library/headers not found and bigendian? Daniel Curry (Apr 15)
• is this a bad traffic? Ronneil Camara (Apr 10)
  • Re: is this a bad traffic? Matt Kettler (Apr 10)
• newbie question mike maxwell (Apr 10)
  • <Possible follow-ups>
  • RE: newbie question Sheahan, Paul (PCLN-NW) (Apr 10)
  • Newbie question Chewie (Apr 20)
    • Re: Newbie question Patrick Harper (Apr 21)
• Linux parameters larosa, vjay (Apr 10)
  • Re: Linux parameters Phil Wood (Apr 11)
• include problem in 1.8.6 Mipam (Apr 10)
  • Re: include problem in 1.8.6 Chris Green (Apr 10)
    • Re: include problem in 1.8.6 Mipam (Apr 10)
      • Re: include problem in 1.8.6 Scott Fringer (Apr 10)
      • Re: include problem in 1.8.6 Mipam (Apr 11)
• Patrick Mullen's webpage? Steve Ochani (Apr 10)
• can't start snort c cheng (Apr 10)
  • Re: can't start snort Erek Adams (Apr 10)
  • <Possible follow-ups>
  • Re: can't start snort c cheng (Apr 10)
    • Re: can't start snort Erek Adams (Apr 11)
  • Re: can't start snort Andreu . Gomez (Apr 11)
• Re: Anomalous packet logged by Snort (fwd) Bill McCarty (Apr 10)
• AW: Patrick Mullen's webpage? Poppi, Sandro (Apr 10)
  • snort_stat Ganu Skop (Apr 11)
• Would you suspect? Ronneil Camara (Apr 11)
  • Re: Would you suspect? Chris Green (Apr 11)
  • <Possible follow-ups>
  • RE: Would you suspect? Ronneil Camara (Apr 11)
  • RE: Would you suspect? Sheahan, Paul (PCLN-NW) (Apr 11)
  • RE: Would you suspect? Ronneil Camara (Apr 11)
• looks false-positive Ronneil Camara (Apr 11)
  • looks false-positive David Bianco (Apr 11)
  • <Possible follow-ups>
  • RE: looks false-positive Ronneil Camara (Apr 11)
  • RE: looks false-positive Ronneil Camara (Apr 11)
• Blocking individual IP's O'Brien, James (Apr 11)
  • <Possible follow-ups>
  • RE: Blocking individual IP's Omolayo Salako (Apr 11)
  • RE: Blocking individual IP's Sean T. Ballard (Apr 11)
  • RE: Blocking individual IP's Ronneil Camara (Apr 11)
    • RE: Blocking individual IP's Frank Knobbe (Apr 13)
• acid on RH7.2 Richard Noonan (Apr 11)
  • Re: acid on RH7.2 Nate S. (Apr 11)
  • <Possible follow-ups>
  • Re: acid on RH7.2 Andreu . Gomez (Apr 11)
    • Re: acid on RH7.2 Richard Noonan (Apr 11)
  • RE: acid on RH7.2 Anthony Liberty (Apr 12)
• RE: snort_stat Sheahan, Paul (PCLN-NW) (Apr 11)
• shell code detect Omolayo Salako (Apr 11)
  • <Possible follow-ups>
  • RE: shell code detect Steve Halligan (Apr 11)
• HPUX configure question Taylor Lewick (Apr 11)
• SNMP complie question Taylor Lewick (Apr 11)
• Unified Alert Output and IP Reversal James Harrison (Apr 11)
  • Re: Unified Alert Output and IP Reversal Michael Scheidell (Apr 15)
  • <Possible follow-ups>
  • RE: Unified Alert Output and IP Reversal Steve Halligan (Apr 11)
• Snort database relationship info? Smith, Israel G (Apr 11)
  • Re: Snort database relationship info? Chris Reid (Apr 11)
  • <Possible follow-ups>
  • RE: Snort database relationship info? Steve Halligan (Apr 11)
  • Re: Snort database relationship info? roman (Apr 11)
  • RE: Snort database relationship info? Smith, Israel G (Apr 11)
• compiling snort with snmp Taylor Lewick (Apr 11)
• interface name in alert? Howell, Paul (Apr 11)
  • Re: interface name in alert? Erek Adams (Apr 11)
  • Re: interface name in alert? Andreas Östling (Apr 11)
• Snorting the MAC address Nate Haggard (Apr 11)
  • Re: Snorting the MAC address Erek Adams (Apr 11)
  • Re: Snorting the MAC address Jason Yates (Apr 11)
  • Re: Snorting the MAC address James Hoagland (Apr 11)
  • <Possible follow-ups>
  • RE: Snorting the MAC address Turner Ryan S CONT KPWA (Apr 11)
  • RE: Snorting the MAC address Matt Kettler (Apr 11)
  • Re: Snorting the MAC address SkatFiend (Apr 12)
• Attenion Windows Users: Latest Snort 1.86 RELEASE Binaries available Michael Steele (Apr 11)
  • RE: Attenion Windows Users: Latest Snort 1.86 RELEASE Binaries available Wayne T Work (Apr 11)
• Source Port 0 traffic Buchanan, Randy (Apr 12)
  • <Possible follow-ups>
  • RE: Source Port 0 traffic Sheahan, Paul (PCLN-NW) (Apr 12)
• IGMP traffic Sheahan, Paul (PCLN-NW) (Apr 12)
• Best Way To Handle New Rules Kevin L Pawloski (Apr 12)
  • Re: Best Way To Handle New Rules Chris Green (Apr 12)
  • Re: Best Way To Handle New Rules Brian (Apr 16)
• Cisco PIX firwalls.. Austin Gonyou (Apr 12)
  • Re: Cisco PIX firwalls.. Ashley Thomas (Apr 12)
  • Re: Cisco PIX firwalls.. Erek Adams (Apr 13)
  • <Possible follow-ups>
  • RE: Cisco PIX firwalls.. Kent Hundley (Apr 14)
  • RE: Cisco PIX firwalls.. Joe Smith (Apr 15)
    • RE: Cisco PIX firwalls.. Erek Adams (Apr 15)
      • RE: Cisco PIX firwalls.. Austin Gonyou (Apr 15)
  • Re: Cisco PIX firwalls.. counter . spy (Apr 15)
    • Re: Cisco PIX firwalls.. Frank Knobbe (Apr 17)
• Snort/ACID Database Cleanup krista l merrill (Apr 12)
  • <Possible follow-ups>
  • RE: Snort/ACID Database Cleanup Ronneil Camara (Apr 12)
    • Re: Snort/ACID Database Cleanup Mark Rowlands (Apr 19)
  • RE: Snort/ACID Database Cleanup Whaley, Mike (Apr 19)
    • Re: Snort/ACID Database Cleanup Mark Rowlands (Apr 19)
• All shellcode rules invalid Rob Hughes (Apr 12)
  • Re: All shellcode rules invalid Andreas Östling (Apr 13)
    • Re: All shellcode rules invalid Rob Hughes (Apr 13)
• need your help noorulsadiqin azbiya (Apr 13)
  • Re: need your help Matt Kettler (Apr 15)
• AW: need your help Poppi, Sandro (Apr 13)
• snort & mysql Hilton De Meillon (Apr 13)
  • Re: snort & mysql Scott Doane (Apr 13)
  • Re: snort & mysql Manuel Pompeia Santos (Apr 13)
  • Re: snort & mysql Alwin Raymundo (Apr 14)
• Re: Snort-users digest, Vol 1 #1789 - 8 msgs lisuke (Apr 13)
• Re: Cisco PIX firwalls & Cisco Routers Scot Scot (Apr 13)
• Rule Sets Ha Hoang (Apr 13)
• tcpdump format Micha Silver (Apr 14)
  • Re: tcpdump format Erek Adams (Apr 14)
• Portscans from China ? Tudor Panaitescu (Apr 14)
  • RE: Portscans from China ? Mike Arrison (Apr 14)
    • Re: Portscans from China ? Michael Scheidell (Apr 15)
• Flexresp problem Tudor Panaitescu (Apr 14)
  • Re: Flexresp problem Erek Adams (Apr 14)
  • <Possible follow-ups>
  • Re: Flexresp problem Tudor Panaitescu (Apr 15)
    • Segmentation fault (core dumped) Carlos Augusto Silva (Apr 15)
      • Re: Segmentation fault (core dumped) Erek Adams (Apr 15)
    • Re: Flexresp problem Erek Adams (Apr 15)
  • Re: Flexresp problem Tudor Panaitescu (Apr 15)
    • Re: Flexresp problem Erek Adams (Apr 15)
  • Re: Flexresp problem Tudor Panaitescu (Apr 15)
  • Re: Flexresp problem Tudor Panaitescu (Apr 20)
    • Re: Flexresp problem Alwin Raymundo (Apr 20)
    • Re: Flexresp problem Erek Adams (Apr 20)
  • Re: Flexresp problem Tudor Panaitescu (Apr 20)
  • Re: Flexresp problem Tudor Panaitescu (Apr 21)
    • Re: Flexresp problem Erek Adams (Apr 21)
• 'more than one result' error messages weidong xiao (Apr 14)
  • <Possible follow-ups>
  • Re: 'more than one result' error messages roman (Apr 15)
• Active Firewalling Patrick Lanphier (Apr 14)
  • Re: Active Firewalling Erek Adams (Apr 14)
• configure snort to drop payloads Lyle Sudin (Apr 14)
  • Re: configure snort to drop payloads Erek Adams (Apr 14)
    • Re: configure snort to drop payloads Lyle Sudin (Apr 16)
      • Re: configure snort to drop payloads Erek Adams (Apr 16)
      • Re: configure snort to drop payloads Lyle Sudin (Apr 17)
      • Re: configure snort to drop payloads Erek Adams (Apr 17)
  • Re: configure snort to drop payloads James Hoagland (Apr 17)
    • Re: configure snort to drop payloads Dr. Richard W. Tibbs (Apr 18)
      • Re: configure snort to drop payloads Chris Keladis (Apr 18)
      • Re: configure snort to drop payloads Alex Pinheiro Machado Rodrigues (Apr 18)
      • Re: Re: configure snort to drop payloads Dr. Richard W. Tibbs (Apr 18)
      • Snort sendme email Carlos Augusto Silva (Apr 18)
      • Re: Snort sendme email Erek Adams (Apr 18)
      • Re: configure snort to drop payloads James Hoagland (Apr 18)
• acid-archive-problem Ed Spick (Apr 14)
• ACID Database Error Demetri Mouratis (Apr 14)
  • <Possible follow-ups>
  • Re: ACID Database Error Andreu . Gomez (Apr 15)
• correlation on a snort sensor Sven Humm (Apr 14)
  • Re: correlation on a snort sensor Erek Adams (Apr 14)
• snort redhat 7.2 server and mysql Kenny D (Apr 14)
  • <Possible follow-ups>
  • Re: snort redhat 7.2 server and mysql Andreu . Gomez (Apr 15)
• Mysql dbschema changed again? How to upgrade? Alan_Kloster (Apr 14)
• GB Snort How ya Doin (Apr 14)
• acceptable packet drop rate for snort lpj0508 (Apr 14)
  • Re: acceptable packet drop rate for snort Erek Adams (Apr 14)
• ICMP Destination Unreachable (Port Unreachable) Tony Wong (Apr 14)
  • Re: ICMP Destination Unreachable (Port Unreachable) Pierre (Apr 14)
  • Re: ICMP Destination Unreachable (Port Unreachable) Erek Adams (Apr 14)
    • RE: ICMP Destination Unreachable (Port Unreachable) Tony Wong (Apr 16)
• Snort/ACID PostgreSQL DB error Demetri Mouratis (Apr 14)
• Where does one find help with Acid? Raymond Jacob (Apr 14)
• will barnyard output full detail for alert? Michael Scheidell (Apr 14)
  • Re: will barnyard output full detail for alert? Andrew R. Baker (Apr 14)
• barnyard problem dotted quad backwards or corrupted? Michael Scheidell (Apr 14)
  • Re: barnyard problem dotted quad backwards or corrupted? Andrew R. Baker (Apr 14)
• New database plugin documentation Roman Danyliw (Apr 14)
• log ftp servers in our network Banai Zoltan (Apr 14)
  • Re: log ftp servers in our network Erek Adams (Apr 14)
  • Message not available
    • Re: log ftp servers in our network Magnus (Apr 14)
  • <Possible follow-ups>
  • Re: log ftp servers in our network piotr . bulczak (Apr 15)
• WEB-ATTACKS id command attempt John-Magne Bredal (Apr 15)
  • Re: WEB-ATTACKS id command attempt Erek Adams (Apr 15)
  • <Possible follow-ups>
  • RE: WEB-ATTACKS id command attempt Gray . Brendan (Apr 15)
    • Re: WEB-ATTACKS id command attempt Phil Wood (Apr 15)
  • Re: WEB-ATTACKS id command attempt Piotr Bulczak (Apr 15)
• ACID + Snort 1.8.6 + Apache 2.0 + PHP 4.2.0 RC 4 Wright, Bob (Apr 15)
  • Re: ACID + Snort 1.8.6 + Apache 2.0 + PHP 4.2.0 RC 4 Thomas Springer (Apr 15)
  • <Possible follow-ups>
  • Re: ACID + Snort 1.8.6 + Apache 2.0 + PHP 4.2.0 RC 4 Andreu . Gomez (Apr 15)
• Best snort list replier / contributor Petriz, Pablo (Apr 15)
  • Re: Best snort list replier / contributor Erek Adams (Apr 15)
  • <Possible follow-ups>
  • RE: Best snort list replier / contributor McCammon, Keith (Apr 15)
    • Re: Best snort list replier / contributor Andreas Östling (Apr 15)
      • Re: Best snort list replier / contributor Erek Adams (Apr 15)
    • RE: Best snort list replier / contributor Erek Adams (Apr 15)
• acid mike maxwell (Apr 15)
  • <Possible follow-ups>
  • ACID mostafa rrrrrr (Jun 01)
    • Re: ACID John Sage (Jun 01)
  • ACID Hall, Duane (Jun 11)
• I found a bug Ronneil Camara (Apr 15)
  • Re: I found a bug Erek Adams (Apr 15)
  • <Possible follow-ups>
  • RE: I found a bug Ronneil Camara (Apr 15)
• Too many stealth alerts Estes, Matt CPR / FCBS (Apr 15)
  • Re: Too many stealth alerts Erek Adams (Apr 15)
  • <Possible follow-ups>
  • RE: Too many stealth alerts Estes, Matt CPR / FCBS (Apr 15)
• Error if I start snort Ali Dogru (Apr 15)
  • Re: Error if I start snort Chris Green (Apr 15)
• Ignoring all traffic from a certain network Stephen C Burns (Apr 15)
  • Re: Ignoring all traffic from a certain network Erek Adams (Apr 15)
  • <Possible follow-ups>
  • RE: Ignoring all traffic from a certain network Wirth, Jeff (Apr 15)
  • Re: Ignoring all traffic from a certain network piotr . bulczak (Apr 15)
  • Ignoring all traffic from a certain network Stephen C Burns (Apr 15)
  • RE: Ignoring all traffic from a certain network Tom Sevy (Apr 15)
• compiling with cc on hpux Taylor Lewick (Apr 15)
• Snort w/SnortSnarf index.html not showings stats Byerly, Ted (Apr 15)
• having trouble with idmef support Andrew Walther (Apr 15)
• How much can snort Snort? Kevin L Pawloski (Apr 15)
  • Re: How much can snort Snort? Phil Wood (Apr 15)
    • Re: How much can snort Snort? Mipam (Apr 15)
  • Re: How much can snort Snort? Roelof JT Jonkman (Apr 15)
• snort 1.8.6 crashing when running two instances on the same interface with Openbsd Jerome Magnin (Apr 15)
  • Re: snort 1.8.6 crashing when running two instances on the same interface with Openbsd Erek Adams (Apr 15)
  • Re: snort 1.8.6 crashing when running two instances on the same interface with Openbsd Chris Green (Apr 15)
  • Re: snort 1.8.6 crashing when running two instances on the same interface with Openbsd Andreas Östling (Apr 16)
• Network Adapter failed with snort ! Nguyen Thai Ha (Apr 15)
  • <Possible follow-ups>
  • Re: Network Adapter failed with snort ! Andreu . Gomez (Apr 16)
• Which version should I use? 1.8.3 .4 .5 or .6 Noller, Gregory (Apr 16)
  • Re: Which version should I use? 1.8.3 .4 .5 or .6 Andrew R. Baker (Apr 16)
• Duplicate sid:257; ???? Stephen Cravey (Apr 16)
  • Re: Duplicate sid:257; ???? Brian (Apr 16)
• Snort, Demarc and excessive logging Ralf Hildebrandt (Apr 16)
• FW: Demarc PureSecure 1.05 may be other (user can bypass login) Ryan Hill (Apr 16)
• ICMP Redirect host Tony Wong (Apr 16)
• How to ignore scan from a host Tony Wong (Apr 16)
  • Re: How to ignore scan from a host Brian (Apr 16)
  • Re: How to ignore scan from a host Erek Adams (Apr 16)
  • <Possible follow-ups>
  • RE: How to ignore scan from a host Sheahan, Paul (PCLN-NW) (Apr 16)
  • Re: How to ignore scan from a host Adrian Voinea (Jun 01)
• Snort and MySQL ./configure problems Noller, Gregory (Apr 16)
  • <Possible follow-ups>
  • RE: Snort and MySQL ./configure problems Estes, Matt CPR / FCBS (Apr 17)
• SSH scans Manuel Pompeia Santos (Apr 16)
• snort performance Christian Kuhtz (Apr 16)
  • RE: snort performance Christian Kuhtz (Apr 16)
  • <Possible follow-ups>
  • RE: RE: snort performance Williams Jon (Apr 16)
    • Re: RE: snort performance james (Apr 17)
      • RE: RE: snort performance Christian Kuhtz (Apr 17)
      • Re: RE: snort performance james (Apr 17)
  • RE: RE: snort performance Williams Jon (Apr 18)
  • RE: RE: snort performance Kreimendahl, Chad J (Apr 18)
• snort-current rules syntax error Sean Wheeler (Apr 16)
  • Re: snort-current rules syntax error Chris Green (Apr 16)
• a little confusion UU/ppp139352 (Apr 16)
  • Re: a little confusion Erek Adams (Apr 17)
• WG: Demarc Security Update Advisory Poppi, Sandro (Apr 16)
  • <Possible follow-ups>
  • RE: WG: Demarc Security Update Advisory Fallon, Benjamin (Apr 18)
  • RE: WG: Demarc Security Update Advisory Ryan Hill (Apr 18)
• AW: Snort and MySQL ./configure problems Poppi, Sandro (Apr 16)
• easy one... J. Craig Woods (Apr 17)
• non privileged portscans Eagle_2-7 (Apr 17)
  • <Possible follow-ups>
  • RE: non privileged portscans Wirth, Jeff (Apr 17)
• DOS MSDTC attempt Kenny D (Apr 17)
  • <Possible follow-ups>
  • Re: DOS MSDTC attempt Kenny D (Apr 17)
  • Re: DOS MSDTC attempt Andreu . Gomez (Apr 17)
• Problems on XP Fuchs Bernhard (Apr 17)
• RV: Snort exploits Petriz, Pablo (Apr 17)
  • RE: RV: Snort exploits Mike Arrison (Apr 17)
    • Re: RV: Snort exploits Chris Green (Apr 17)
  • <Possible follow-ups>
  • RE: RV: Snort exploits counter . spy (Apr 17)
  • RE: RV: Snort exploits counter . spy (Apr 17)
• www.snort.org down? wfenwick (Apr 17)
  • Re: www.snort.org down? Gerardo Gregory (Apr 17)
  • Re: www.snort.org down? Phil Wood (Apr 17)
• Problem enabling flexresp bthaler (Apr 17)
  • Re: Problem enabling flexresp bthaler (Apr 17)
  • Re: Problem enabling flexresp Erek Adams (Apr 17)
    • Re: Problem enabling flexresp bthaler (Apr 17)
• FreeBSD + Mysql + Snort Hall, Duane (Apr 17)
  • <Possible follow-ups>
  • RE: FreeBSD + Mysql + Snort Wirth, Jeff (Apr 17)
  • RE: FreeBSD + Mysql + Snort Hall, Duane (Apr 17)
    • RE: FreeBSD + Mysql + Snort Erek Adams (Apr 17)
  • FreeBSD + Mysql + Snort Hall, Duane (Apr 17)
  • RE: FreeBSD + Mysql + Snort Hall, Duane (Apr 17)
• Red Hat's 2.4.2 Kernel version compatibility Konstantinos Papadakis (Apr 17)
  • Re: Red Hat's 2.4.2 Kernel version compatibility Steve Ochani (Apr 17)
    • Re: Red Hat's 2.4.2 Kernel version compatibility Leonardo Alcantara Moreira (Apr 29)
• Snort + OpenBSD3.0 "Easy" Questions Ken Schweigert (Apr 17)
  • Re: Snort + OpenBSD3.0 "Easy" Questions [Solved] Ken Schweigert (Apr 19)
• Setting an alert for a "connection threshold" Stephen C Burns (Apr 17)
• Can I get alerts for IM Paul . Simons (Apr 17)
• Fw: Re: Snort exploits Dragos Ruiu (Apr 17)
  • <Possible follow-ups>
  • Re: Snort exploits Chris Green (Apr 24)
    • Re: Snort exploits Jose Nazario (Apr 25)
• Win2k and dial-up connection Christian Nesmark (Apr 17)
• Snort defining WORDS_BIGENDIAN Ashley Thomas (Apr 17)
• memory allocate error check Peng Yong (Apr 17)
• Snort, mysql logging problems Tony Wong (Apr 17)
• fragroute vs. snort: the tempest in a teacup Dragos Ruiu (Apr 17)
  • Re: fragroute vs. snort: the tempest in a teacup Dug Song (Apr 18)
    • Re: fragroute vs. snort: the tempest in a teacup Darren Reed (Apr 18)
      • Re: fragroute vs. snort: the tempest in a teacup Ron DuFresne (Apr 19)
      • RE: fragroute vs. snort: the tempest in a teacup Enno Rey (Apr 19)
      • Re: fragroute vs. snort: the tempest in a teacup Marco Thorbruegge (Apr 19)
      • Re: fragroute vs. snort: the tempest in a teacup Crist J. Clark (Apr 20)
    • Re: fragroute vs. snort: the tempest in a teacup Francis Cianfrocca (Apr 18)
      • Re: Re: fragroute vs. snort: the tempest in a teacup Jason Haar (Apr 18)
  • <Possible follow-ups>
  • Re: fragroute vs. snort: the tempest in a teacup Brad Powell (Apr 19)
  • Re: fragroute vs. snort: the tempest in a teacup Steven M. Bellovin (Apr 19)
  • RE: fragroute vs. snort: the tempest in a teacup Craig, Scott (Apr 25)
    • RE: fragroute vs. snort: the tempest in a teacup Ron DuFresne (Apr 25)
• insertion and evasion Federico Lombardo (Apr 18)
  • Re: insertion and evasion Saad Kadhi (Apr 18)
• mysql 100% cpu utliization Redman, Ken (Apr 18)
  • Re: mysql 100% cpu utliization Christian Kuhtz (Apr 18)
  • Re: mysql 100% cpu utliization Erek Adams (Apr 18)
• help! 李 洪源 (Apr 18)
  • Re: help! Erek Adams (Apr 18)
  • <Possible follow-ups>
  • Re: help! 李 洪源 (Apr 19)
    • Re: help! Erek Adams (Apr 19)
    • Re: help! Erek Adams (Apr 19)
• Snort on HPUX Taylor Lewick (Apr 18)
  • Re: Snort on HPUX James Hoagland (Apr 18)
• signature for a virus Ronneil Camara (Apr 18)
• snort_stat.pl John Hally (Apr 18)
  • <Possible follow-ups>
  • RE: snort_stat.pl Sheahan, Paul (PCLN-NW) (Apr 18)
  • RE: snort_stat.pl Wirth, Jeff (Apr 18)
  • snort_stat.pl John Hally (May 21)
  • snort_stat.pl Jevoš Peter (May 27)
  • snort_stat.pl Jevoš Peter (May 29)
• Segfault on SMB Alert Whyte, Jesse (Apr 18)
• Addendum: Segfault on SMB Alert Whyte, Jesse (Apr 18)
  • Re: Addendum: Segfault on SMB Alert Erek Adams (Apr 18)
• Fw: LOG DE ERRO Carlos Augusto Silva (Apr 18)
  • Re: Fw: LOG DE ERRO bruno taranto (Apr 18)
• Snort on Windows 2000 Server platform. Mikhail Koulechov (Apr 18)
  • RE: Snort on Windows 2000 Server platform. Michael Steele (Apr 18)
  • <Possible follow-ups>
  • RE: Snort on Windows 2000 Server platform. Whaley, Mike (Apr 18)
• ERROR LOG Carlos Augusto Silva (Apr 18)
  • Re: ERROR LOG bthaler (Apr 18)
    • Re: ERROR LOG Sam (Apr 18)
  • Re: ERROR LOG JPP (Apr 18)
  • <Possible follow-ups>
  • RE: ERROR LOG Wirth, Jeff (Apr 18)
  • RE: ERROR LOG Ronneil Camara (Apr 18)
• hp compile question Taylor Lewick (Apr 18)
  • Re: hp compile question Chris Green (Apr 18)
• Thanks a bunch, seriously Taylor Lewick (Apr 18)
• Snort in Brazil Alex Pinheiro Machado Rodrigues (Apr 18)
• make error in snort-current spo_SnmpTrap.@OBJEXT@ Mark Rowlands (Apr 19)
  • Re: make error in snort-current spo_SnmpTrap.@OBJEXT@ Chris Green (Apr 19)
    • Re: make error in snort-current spo_SnmpTrap.@OBJEXT@ Mark Rowlands (Apr 19)
• Acid Fatal error Kenny D (Apr 19)
  • <Possible follow-ups>
  • Re: Acid Fatal error roman (Apr 19)
• RE: Question about Demarc Andrew Blevins (Apr 19)
  • <Possible follow-ups>
  • Question about Demarc Spy Guy (Apr 19)
  • RE: Question about Demarc larosa, vjay (Apr 19)
• Snort 1.8.4 Potts, Ross A. (Apr 19)
• Syslog output other file Carlos Augusto Silva (Apr 19)
  • Re: Syslog output other file Erek Adams (Apr 19)
    • Re: Syslog output other file Carlos Augusto Silva (Apr 19)
      • Re: Syslog output other file Erek Adams (Apr 19)
  • Re: Syslog output other file Matt Kettler (Apr 19)
  • <Possible follow-ups>
  • RE: Syslog output other file Wirth, Jeff (Apr 19)
• Snort syslog em outro arquivo Carlos Augusto Silva (Apr 19)
• Snort XML Report Generation Matthew J. Vinton (Apr 19)
• snort not logging to log files.. Ross Tsolakidis (Apr 19)
  • Re: snort not logging to log files.. Erek Adams (Apr 19)
  • <Possible follow-ups>
  • RE: snort not logging to log files.. Ross Tsolakidis (Apr 22)
    • RE: snort not logging to log files.. Erek Adams (Apr 22)
• Re: simple mistake in icmp payload calculation Roman Danyliw (Apr 20)
  • <Possible follow-ups>
  • simple mistake in icmp payload calculation Oliver Friesen (Apr 20)
• snort cvs complains Ralf Hildebrandt (Apr 20)
  • Message not available
    • Re: snort cvs complains Ralf Hildebrandt (Apr 20)
  • <Possible follow-ups>
  • RE: snort cvs complains Ronneil Camara (Apr 20)
    • Re: snort cvs complains Ralf Hildebrandt (Apr 20)
• Re: [Snort-sigs] RESP not working in rules Matt Kettler (Apr 20)
• AW: Newbie question Poppi, Sandro (Apr 21)
• what is good Onie Camara (Apr 21)
  • Re: what is good John Sage (Apr 21)
    • Re: what is good ScotScot (Apr 21)
      • Re: what is good ScotScot (Apr 21)
      • Re: what is good Onie Camara (Apr 21)
  • <Possible follow-ups>
  • Re: what is good Andreu . Gomez (Apr 22)
• proper usage of $SHELLCODE_PORTS ? Jon Hart (Apr 21)
  • <Possible follow-ups>
  • RE: proper usage of $SHELLCODE_PORTS ? larosa, vjay (Apr 21)
    • Re: proper usage of $SHELLCODE_PORTS ? Jon Hart (Apr 21)
      • Message not available
      • Re: proper usage of $SHELLCODE_PORTS ? Jon Hart (Apr 22)
    • Re: proper usage of $SHELLCODE_PORTS ? Martin Roesch (Apr 22)
  • RE: proper usage of $SHELLCODE_PORTS ? larosa, vjay (Apr 22)
• SnortSnarf Compile error nanthan (Apr 21)
  • <Possible follow-ups>
  • Re: SnortSnarf Compile error Andreu . Gomez (Apr 22)
• writing snort rules ? <newbies> Anthony Liberty (Apr 22)
  • Re: writing snort rules ? <newbies> Erek Adams (Apr 22)
• LogCheck Carlos Augusto Silva (Apr 22)
• SHELLCODE x86 unicode NOOP Tony Wong (Apr 22)
  • Re: SHELLCODE x86 unicode NOOP Erek Adams (Apr 22)
  • Re: SHELLCODE x86 unicode NOOP Dragos Ruiu (Apr 22)
• Oinkmaster v0.4 Andreas Östling (Apr 22)
• HOME_NET question... Bob Hillegas (Apr 22)
  • Re: HOME_NET question... Erek Adams (Apr 22)
    • Re: HOME_NET question... John Sage (Apr 22)
      • Re: HOME_NET question... Bob Hillegas (Apr 23)
      • Re: HOME_NET question... Phil Wood (Apr 23)
• Snort installation document for review. Aidan Carty (Apr 22)
  • Re: Snort installation document for review. Jon Ottar Runde (Apr 23)
• writing to log file and running a script at once??? Lookman Fazal (Apr 22)
  • Re: writing to log file and running a script at once??? Erek Adams (Apr 22)
• SHELLCODE x86 EB OC NOOP Tony (Apr 22)
• RE: writing to log file and running a script at onc e??? Omolayo Salako (Apr 22)
• fragroute related fixes need testing on real networks Chris Green (Apr 22)
  • Re: fragroute related fixes need testing on real networks Martin Roesch (Apr 22)
  • Re: [Snort-devel] fragroute related fixes need testing on real networks Chris Green (Apr 22)
    • Re: [Snort-devel] fragroute related fixes need testing on real networks Chris Green (Apr 23)
• OT: ipfilter Suggestions for Snort Use Ryan Hill (Apr 22)
  • Re: OT: ipfilter Suggestions for Snort Use James Ainslie (Apr 23)
  • <Possible follow-ups>
  • RE: OT: ipfilter Suggestions for Snort Use Justin Honold (Apr 23)
• Mandrake 8.0 nitewalker (Apr 22)
  • Re: Mandrake 8.0 Erek Adams (Apr 22)
• Snort In the news: RE: Fragroute Greg Wright (Apr 22)
• regarding Snort design. Ashley Thomas (Apr 22)
  • Re: regarding Snort design. Erek Adams (Apr 22)
• Snort and network taps counter . spy (Apr 23)
  • Re: Snort and network taps Chris Green (Apr 23)
  • Re: Snort and network taps Jeff Nathan (Apr 23)
    • Re: Snort and network taps Jason Haar (Apr 23)
      • Re: Snort and network taps Jeff Nathan (Apr 23)
      • Re: Snort and network taps Jason Haar (Apr 23)
  • <Possible follow-ups>
  • RE: Snort and network taps Wirth, Jeff (Apr 23)
  • RE: Snort and network taps Fuchs Bernhard (Apr 24)
• Snort install document for peer review. Aidan Carty (Apr 23)
  • Re: Snort install document for peer review. Patrick Harper (Apr 23)
• AW: Snort and network taps Poppi, Sandro (Apr 23)
• Barnyard reversing IPs Pricher Jeffrey Cntr 868CS/SCOY (Apr 23)
• <no subject> Nils Michaelsen (Apr 23)
• List of explanations for methods? Lepchenske, Craig L (Raytheon) (Apr 23)
• snort 1.8.6 tarball on Red Hat 7.2 Nils Michaelsen (Apr 23)
• Dynamic rule activation/deactivation. Ashley Thomas (Apr 23)
  • Re: Dynamic rule activation/deactivation. Chris Green (Apr 23)
• port 135 scans Michael Anderson (Apr 23)
• Tuning snort rules. Ian Macdonald (Apr 23)
  • Re: Tuning snort rules. Erek Adams (Apr 24)
  • <Possible follow-ups>
  • RE: Tuning snort rules. Williams Jon (Apr 24)
    • Re: Tuning snort rules. Ian Macdonald (Apr 24)
  • RE: Tuning snort rules. Williams Jon (Apr 24)
• alerts Jason Burnett (Apr 23)
  • <Possible follow-ups>
  • Alerts Darren Young (Jun 08)
    • Re: Alerts Ian Macdonald (Jun 13)
      • Re: Alerts Ed Spick (Jun 14)
• snort uberscript Jeff Nathan (Apr 23)
• Signature names Mike Macias (Apr 23)
  • Re: Signature names Andrew R. Baker (Apr 23)
  • <Possible follow-ups>
  • RE: Signature names Redman, Ken (Apr 24)
• snort recieved signal 3, exiting steve nutt (Apr 23)
• stream4 oddity Frank Knobbe (Apr 23)
  • Re: stream4 oddity Chris Green (Apr 24)
    • Re: stream4 oddity Frank Knobbe (Apr 24)
• Error initializing NIC sheabo (Apr 24)
  • <Possible follow-ups>
  • RE: Error initializing NIC Reinhard Doberstein (Apr 24)
  • RE: Error initializing NIC Reinhard Doberstein (Apr 24)
• Re: Snort-users -- confirmation of subscription -- request 370109 Nanthan (Apr 24)
• confirm 370109 Nanthan (Apr 24)
• Alert Method in Snort & SnortSnarf Pathmenanthan Ramakrishna (Apr 24)
  • <Possible follow-ups>
  • RE: Alert Method in Snort & SnortSnarf Potts, Ross A. (Apr 24)
• howto test snort ? Hilton De Meillon (Apr 24)
• Alert File in Snort & SnortSnarf nanthan (Apr 24)
• Snort Rules Database James Ainslie (Apr 24)
• snort logging to sybase Galappatti, Kishantha (Apr 24)
• p2p bird-dog rules Mike Shaw (Apr 24)
  • p2p bird-dog rules David Bianco (Apr 24)
  • Re: p2p bird-dog rules Erek Adams (Apr 24)
• RE: stream4 oddity --- Update Frank Knobbe (Apr 24)
  • Re: stream4 oddity --- Update Chris Green (Apr 24)
• STEALTH ACTIVITY (NULL scan) ??? Ing. Daniel Manrique (Apr 24)
  • <Possible follow-ups>
  • RE: STEALTH ACTIVITY (NULL scan) ??? McCammon, Keith (Apr 24)
• fragrouter missed beginning Jason Yates (Apr 24)
  • Re: fragrouter missed beginning Chris Green (Apr 24)
• snort and big brother Taylor Lewick (Apr 24)
  • <Possible follow-ups>
  • Re: snort and big brother Sentinel Sentinel (Apr 24)
• New options coming out in 1.8.7beta1 Chris Green (Apr 24)
• snort 186 does not detect/log any portscans counter . spy (Apr 24)
  • <Possible follow-ups>
  • Re: snort 186 does not detect/log any portscans counter . spy (Apr 25)
• gigabit ids Sean A Ensz/cis/evp/Okstate (Apr 24)
  • Re: gigabit ids Leigh David Heyman (Apr 24)
• Snot based attacks and the -z est option. larosa, vjay (Apr 24)
  • <Possible follow-ups>
  • FW: Snot based attacks and the -z est option. larosa, vjay (Apr 25)
  • RE: Snot based attacks and the -z est option. counter . spy (Apr 25)
    • Re: Snot based attacks and the -z est option. Chris Green (Apr 26)
      • Re: Snot based attacks and the -z est option. counter . spy (Apr 26)
      • Re: Snot based attacks and the -z est option. Chris Green (Apr 26)
  • RE: Snot based attacks and the -z est option. larosa, vjay (Apr 25)
  • RE: Snot based attacks and the -z est option. larosa, vjay (Apr 26)
    • Re: Snot based attacks and the -z est option. Chris Green (Apr 26)
  • RE: Snot based attacks and the -z est option. larosa, vjay (Apr 26)
  • RE: Snot based attacks and the -z est option. larosa, vjay (Apr 26)
• SnortSam update Frank Knobbe (Apr 24)
  • SnortSam update: PIX and Cisco ACLs Frank Knobbe (May 06)
    • Re: IDS: SnortSam update: PIX and Cisco ACLs Ralf Hildebrandt (May 14)
• real basic starter rules Harry Putnam (Apr 24)
  • Re: real basic starter rules Phil Wood (Apr 25)
    • Re: real basic starter rules Harry Putnam (Apr 25)
      • Re: real basic starter rules Harry Putnam (Apr 26)
      • Re: real basic starter rules Rich Adamson (Apr 27)
      • Re: real basic starter rules Harry Putnam (Apr 27)
• RE: Buffer too small for packet.dll? (was: Error initializing NIC) John Goggan (Apr 24)
• Windows SNORT XML Logs Jason Withrow (Apr 25)
• RE: Buffer too small for packet.dll? (was: Error i nitializing NIC) Reinhard Doberstein (Apr 25)
  • Re: Buffer too small for packet.dll? (was: Error initializing NIC) Chris Reid (Apr 25)
• defining $external_net Metz, Tim (Apr 25)
  • Re: defining $external_net Erek Adams (Apr 25)
  • <Possible follow-ups>
  • RE: defining $external_net Wirth, Jeff (Apr 25)
  • RE: defining $external_net Tom Sevy (Apr 25)
  • RE: defining $external_net Metz, Tim (Apr 25)
• Disabling state alerts separately from evasion alerts Chris Green (Apr 25)
• Q-ICMP rule/IDS202 mike (Apr 25)
  • <Possible follow-ups>
  • RE: Q-ICMP rule/IDS202 Wirth, Jeff (Apr 25)
    • ACID bug with archiving Anton A. Chuvakin (Apr 25)
• Advice on the Network Infrastructure Side of IDS Design... Mike Ahern (Apr 25)
  • <Possible follow-ups>
  • RE: Advice on the Network Infrastructure Side of IDS Design... counter . spy (Apr 25)
• Snort dying unexpectedly John Hally (Apr 25)
  • Re: Snort dying unexpectedly Chris Green (Apr 25)
  • Re: Snort dying unexpectedly Skip Carter (Apr 25)
    • Re: Snort dying unexpectedly Chris Green (Apr 25)
  • <Possible follow-ups>
  • RE: Snort dying unexpectedly John Hally (Apr 25)
    • Re: Snort dying unexpectedly Chris Green (Apr 25)
  • RE: Snort dying unexpectedly Tom Sevy (Apr 25)
  • RE: Snort dying unexpectedly John Hally (Apr 25)
• Is this a real nimda? Ronneil Camara (Apr 25)
  • <Possible follow-ups>
  • RE: Is this a real nimda? Sheahan, Paul (PCLN-NW) (Apr 25)
• rule question Taylor Lewick (Apr 25)
  • <Possible follow-ups>
  • RE: rule question Frank Knobbe (Apr 25)
• KLEZ Alejandro Flores (Apr 25)
  • Re: KLEZ Onie Camara (Apr 25)
• Snort rules James Ainslie (Apr 25)
  • Re: Snort rules Erek Adams (Apr 25)
  • <Possible follow-ups>
  • snort rules mostafa rrrrrr (May 27)
• Razorback Sheahan, Paul (PCLN-NW) (Apr 25)
• SMTP RCPT TO overflow Jhumri Tilayia (Apr 25)
  • Re: SMTP RCPT TO overflow Ralf Hildebrandt (Apr 25)
  • Re: SMTP RCPT TO overflow Jason Haar (Apr 25)
    • Message not available
      • Re: SMTP RCPT TO overflow Jason Haar (May 06)
      • REMOVE Jason Haar from the list! Martin Forest (May 07)
      • Re: REMOVE Jason Haar from the list! Matt Kettler (May 07)
      • RE: REMOVE Jason Haar from the list! Jason Withrow (May 07)
      • Re: REMOVE Jason Haar from the list! Jason Haar (May 07)
  • <Possible follow-ups>
  • smtp rcpt to overflow Hugo Ferr (Jun 05)
    • RE: smtp rcpt to overflow Hugh Brown (Jun 05)
      • RE: smtp rcpt to overflow Ted Stringer (Jun 05)
    • Re: smtp rcpt to overflow Edwin Eefting (Jun 05)
• Freebsd Snort starts with no errors but goes to bpf in top 0% cpu Alan_Kloster (Apr 25)
• Tag: and mysql and Demarc. Ian Macdonald (Apr 25)
• HP-UX /Sparc/ Linux/weirdplatform users Chris Green (Apr 25)
• Snort Users Group IN San Francisco Bay ? Mikael Fantaye (Apr 25)
• snort-users mailinglist trigger snort Martin Forest (Apr 25)
  • Re: snort-users mailinglist trigger snort Jason Haar (Apr 25)
• snort sigs for Solaris login exploit? Russell Fulton (Apr 25)
  • Re: [unisog] Solaris system compromised via telnet. New exploit? Andreas Östling (Apr 26)
• RE: Freebsd Snort starts with no errors but goes to bpf in top 0% cpu Wirth, Jeff (Apr 26)
  • <Possible follow-ups>
  • RE: Freebsd Snort starts with no errors but goes to bpf in top 0% cpu Alan_Kloster (Apr 26)
  • RE: Freebsd Snort starts with no errors but goes to bpf in top 0% cpu Wirth, Jeff (Apr 26)
• Snort user's group in NOVA ? Jhumri Tilayia (Apr 26)
  • <Possible follow-ups>
  • RE: Snort user's group in NOVA ? McCammon, Keith (Apr 26)
• Archiving Snort--mysql questions Whaley, Mike (Apr 26)
• ACTION: Snort user's group in NOVA ? McCammon, Keith (Apr 26)
  • Re: ACTION: Snort user's group in NOVA ? Martin Roesch (Apr 29)
  • <Possible follow-ups>
  • RE: ACTION: Snort user's group in NOVA ? Sean T. Ballard (Apr 29)
  • RE: ACTION: Snort user's group in NOVA ? Jason Brvenik (Apr 29)
• Commercial version of Snort Laurent Cabal (Apr 26)
  • Re: Commercial version of Snort mike maxwell (Apr 26)
• Snort signatures Laurent Cabal (Apr 26)
  • Re: Snort signatures Matt Kettler (Apr 26)
  • Re: Snort signatures Chris Green (Apr 26)
• Newbie need advice ! Gabriel Zabal (Apr 26)
• AnalogX (OT) Tim Sailer (Apr 26)
• correlating alerts with action required Mike Sapsara (Apr 26)
  • <Possible follow-ups>
  • RE: correlating alerts with action required Wirth, Jeff (Apr 26)
• question about finding out about traffic Taylor Lewick (Apr 26)
  • Re: question about finding out about traffic Matt Kettler (Apr 26)
• Re: Vol 1 #1833 Msg#10 Joe Pampel (Apr 26)
• got demarc 1.6? Ryan Hill (Apr 26)
• winpcap Ed McMan (Apr 27)
  • Re: winpcap Chris Reid (Apr 27)
  • <Possible follow-ups>
  • RE: winpcap Reinhard Doberstein (Apr 29)
• Wondering if any of you have seen the following subject line Phil Wood (Apr 27)
• barnyard ignores msg text on custom rules? Michael Scheidell (Apr 27)
  • Re: barnyard ignores msg text on custom rules? Andrew R. Baker (Apr 28)
• Sensors and Home Net Chewie (Apr 27)
• MySQL Chewie (Apr 27)
  • Re: MySQL Shawn Duffy (Apr 27)
  • <Possible follow-ups>
  • RE: MySQL Chewie (Apr 27)
• Hogwash Chewie (Apr 27)
• "Flow" problem Harald Finnaas (Apr 28)
  • Re: "Flow" problem Phil Wood (Apr 28)
  • Re: "Flow" problem Chris Green (Apr 28)
  • <Possible follow-ups>
  • re: "Flow" problem Harald Finnaas (Apr 28)
• Delete sensors from DB Harald Finnaas (Apr 28)
• snort wont log to mysql database mnichols (Apr 28)
  • <Possible follow-ups>
  • RE: snort wont log to mysql database Semerjian, Ohanes (Apr 29)
• Example Script for Snort Ali Dogru (Apr 28)
• AW: Example Script for Snort Poppi, Sandro (Apr 29)
• cmd.exe Ronald Prins (Apr 29)
  • Re: cmd.exe Martin Forest (Apr 29)
  • Re: cmd.exe Grace Pittmon (Apr 29)
  • Re: cmd.exe Michael Scheidell (Apr 29)
  • <Possible follow-ups>
  • RE: cmd.exe Potts, Ross A. (Apr 29)
• "id command attempt" rule Risto Vaarandi (Apr 29)
• NO UDP visibility Matt Furminger (Apr 29)
  • Re: NO UDP visibility Matt Kettler (Apr 29)
• any snort group in new jersey Omolayo Salako (Apr 29)
  • <Possible follow-ups>
  • RE: any snort group in new jersey Keith Pachulski (Apr 29)
• msql error Omolayo Salako (Apr 29)
  • <Possible follow-ups>
  • RE: msql error Omolayo Salako (Apr 29)
• Question about alert output configuration. Joshua Laase (Apr 29)
• Snort user groups pbsarnac (Apr 29)
• ACID Database Cleanup (data.MYD) krista l merrill (Apr 29)
  • <Possible follow-ups>
  • RE: ACID Database Cleanup (data.MYD) Michael Aylor (Apr 29)
  • RE: ACID Database Cleanup (data.MYD) Sentinel Sentinel (Apr 29)
• mysql archive tool Jason Monroe (Apr 29)
  • Re: mysql archive tool Roberto Suarez Soto (Apr 30)
  • <Possible follow-ups>
  • RE: mysql archive tool Estes, Matt CPR / FCBS (Apr 30)
• Strange UDP packets from MS Exchange servers Sheahan, Paul (PCLN-NW) (Apr 29)
  • <Possible follow-ups>
  • RE: Strange UDP packets from MS Exchange servers Semerjian, Ohanes (Apr 29)
• snort 1.8.6 db schema? Ryan Hill (Apr 29)
  • <Possible follow-ups>
  • RE: snort 1.8.6 db schema? Ryan Hill (Apr 29)
• Out of the Office Robert M Gulledge (Apr 29)
  • <Possible follow-ups>
  • Out of the office kg (Jun 23)
• pid file, how do I create one? Vadim Pushkin (Apr 30)
  • RE: pid file, how do I create one? Jeff Dell (Apr 30)
  • <Possible follow-ups>
  • RE: pid file, how do I create one? Vadim Pushkin (Apr 30)
    • Re: pid file, how do I create one? Michael Anderson (Apr 30)
  • Re: pid file, how do I create one? Vadim Pushkin (Apr 30)
• Old rule getting set off a lot lately Redman, Ken (Apr 30)
• My http server is port 8080, how do I change rules file/s? Vadim Pushkin (Apr 30)
• OT: workstation security assurance F.M. Taylor (Apr 30)
  • <Possible follow-ups>
  • OT: Workstation security assurance F.M. Taylor (Apr 30)
• Filesize limit exceeded krista l merrill (Apr 30)
  • <Possible follow-ups>
  • RE: Filesize limit exceeded counter . spy (May 01)
    • RE: Filesize limit exceeded Erek Adams (May 01)
• GUI Help Needed Jason Withrow (Apr 30)
• Fragments and stuff Ian Macdonald (Apr 30)
  • <Possible follow-ups>
  • RE: Fragments and stuff Sheahan, Paul (PCLN-NW) (Apr 30)
    • RE: Fragments and stuff Ian Macdonald (Apr 30)
• Spurious Alerts? Finney Charles E (Apr 30)
  • Spurious Alerts? David Bianco (Apr 30)
  • <Possible follow-ups>
  • RE: Spurious Alerts? Finney Charles E (Apr 30)
• Unable to compile latest with MySQL on OpenBSD Vadim Pushkin (Apr 30)
  • <Possible follow-ups>
  • RE: Unable to compile latest with MySQL on OpenBSD Wirth, Jeff (Apr 30)
  • RE: Unable to compile latest with MySQL on OpenBSD Vadim Pushkin (Apr 30)
  • RE: Unable to compile latest with MySQL on OpenBSD Vadim Pushkin (May 01)
  • RE: Unable to compile latest with MySQL on OpenBSD Wirth, Jeff (May 01)
• Fragroute binaries for WindowsNT/2000 (Off- Topic) Hever C. Rocha - N.O.C (Apr 30)
  • Re: Fragroute binaries for WindowsNT/2000 (Off- Topic) Frank Knobbe (Apr 30)
• Odd question... Martin Forest (Apr 30)
  • Re: Odd question... Harald Finnaas (Apr 30)
  • Re: Odd question... Alejandro Flores (Apr 30)
  • Re: Odd question... Demetri Mouratis (May 01)
  • <Possible follow-ups>
  • Re: Odd question... Vadim Pushkin (Apr 30)
• Re: Snort Reporting Actual HTTP Destination Phil Wood (Apr 30)
• Rules ordering question. larosa, vjay (Apr 30)
  • <Possible follow-ups>
  • RE: Rules ordering question. Williams Jon (May 01)
  • RE: Rules ordering question. Williams Jon (May 02)
• Snort, Stream4 State and Ethernet Taps. larosa, vjay (Apr 30)
  • <Possible follow-ups>
  • RE: Snort, Stream4 State and Ethernet Taps. Wirth, Jeff (May 01)
    • Alerting Snort (sending alert through pager) Alwin Raymundo (May 03)
  • RE: Snort, Stream4 State and Ethernet Taps. counter . spy (May 01)
  • RE: Snort, Stream4 State and Ethernet Taps. larosa, vjay (May 01)
  • RE: Snort, Stream4 State and Ethernet Taps. counter . spy (May 01)
• Can you simply merge separate Snort SQL databases? Jason Haar (Apr 30)
  • <Possible follow-ups>
  • RE: Can you simply merge separate Snort SQL databases? David E. Wach (May 01)
    • Re: Can you simply merge separate Snort SQL databases? Jason Haar (May 01)
  • RE: Can you simply merge separate Snort SQL databases? David E. Wach (May 02)
• Command line overrides? J. Craig Woods (Apr 30)
• BUG of "config bpf_file" Peng Yong (May 01)
  • Re: BUG of "config bpf_file" Phil Wood (May 01)
    • Re: BUG of "config bpf_file" Peng Yong (May 01)
      • Re: BUG of "config bpf_file" Phil Wood (May 01)
      • snortconf via web Mr. F Phat's (May 01)
      • Re: snortconf via web Erek Adams (May 02)
      • RE: snortconf via web Robert S. (May 03)
      • RE: snortconf via web Erek Adams (May 03)
      • RE: snortconf via web Jeff Dell (May 03)
      • RE: snortconf via web Robert S. (May 03)
• RE: Snort SNMP Variables are not consistent? Metz, Tim (May 01)
  • <Possible follow-ups>
  • RE: Snort SNMP Variables are not consistent? larosa, vjay (May 01)
• Errors when initiating my sensors. Vadim Pushkin (May 01)
  • Re: Errors when initiating my sensors. Andreas Östling (May 01)
  • <Possible follow-ups>
  • RE: Errors when initiating my sensors. Wirth, Jeff (May 01)
• unable to compile latest with mysql on linux Hans-Cees Speel (May 01)
• Snort 1.8 Win32 Ernesto T. Negron (May 01)
  • <Possible follow-ups>
  • RE: Snort 1.8 Win32 Fallon, Benjamin (May 01)
  • RE: Snort 1.8 Win32 Reinhard Doberstein (May 02)
• Keeping a 2 week running backup of MySQL snortdb JC (May 01)
• barnyard alert_fast not compatible with snort -A fast? Michael Scheidell (May 01)
• Broken Signature SMTP RCPT TO Ian Macdonald (May 01)
• Portscan.log utility Steve Rudolph (May 01)
  • Re: Portscan.log utility Erek Adams (May 01)
  • <Possible follow-ups>
  • RE: Portscan.log utility Dell, Jeffrey (May 01)
  • RE: Portscan.log utility Ryan Hill (May 01)
• barnyard and demarc question Omolayo Salako (May 01)
  • Re: barnyard and demarc question Roelof JT Jonkman (May 01)
• Demarc Chewie (May 01)
  • Re: Demarc Erek Adams (May 02)
    • snort problem on HP-UX 11.00 and TokenRing Karl Lovink (May 02)
      • Re: snort problem on HP-UX 11.00 and TokenRing Chris Green (May 02)
    • Re: Demarc Manuel Pompeia Santos (May 02)
• snort rule question.. Taylor Lewick (May 02)
  • Re: snort rule question.. Matt Kettler (May 02)
• RE : snortconf via web Christophe Sahut (May 02)
• Who Do I contact about posting something on the Snort.org website? Steve Scott (May 02)
  • Re: Who Do I contact about posting something on the Snort.org website? Chris Green (May 02)
• W2k - WinAt - Stopping Snort Brian Ertel (May 02)
• Snort DB configuration MOHESOWA BYAS (May 02)
  • Re: Snort DB configuration Mike Macias (May 02)
    • Re: Snort DB configuration Daniel Curry (May 02)
  • <Possible follow-ups>
  • RE: Snort DB configuration Wirth, Jeff (May 02)
• Apology Phil Wood (May 02)
• Alerting from Snort -- NOT HOW-TO, but what.... Tom Sevy (May 02)
  • <Possible follow-ups>
  • RE: Alerting from Snort -- NOT HOW-TO, but what.... Wirth, Jeff (May 02)
• monitoring https / SSL Slade Edmonds (May 02)
  • Re: monitoring https / SSL Jason Haar (May 02)
  • <Possible follow-ups>
  • RE: monitoring https / SSL McCammon, Keith (May 02)
  • RE: monitoring https / SSL Matt Kettler (May 02)
• SNMP Problems Leandro A Ferreira (May 02)
  • Re: SNMP Problems Matt Kettler (May 02)
  • Re: SNMP Problems Richard Noonan (May 02)
  • <Possible follow-ups>
  • SNMP Problems Groce, Jonathan (CRTATL) (May 02)
• newbie log question Eric Garnel (May 02)
• Automating Snort on W2k using WinAt Brian Ertel (May 02)
  • <Possible follow-ups>
  • Re: Automating Snort on W2k using WinAt Andrew . Zielinski (May 02)
    • Re: Automating Snort on W2k using WinAt Chris Reid (May 02)
  • RE: Automating Snort on W2k using WinAt Sylar, John (May 03)
  • RE: Automating Snort on W2k using WinAt Brown, Bobby (US - Hermitage) (May 03)
• Attention Windows Users: Latest Snort 1.87b113 Binaries available - Fixed WinPcap Error Michael Steele (May 02)
• Database maintence scripts Ian Macdonald (May 02)
• Help]snort does not run in intrusion detection mode(Bus error) on OpenBSD-2.9-Sparc 김영성 (May 02)
• Snort IGNORES var HOME_NET counterping (May 03)
  • Re: Snort IGNORES var HOME_NET Matt Kettler (May 03)
  • Re: Snort IGNORES var HOME_NET Leonardo Alcantara Moreira (May 03)
  • <Possible follow-ups>
  • RE: Snort IGNORES var HOME_NET Ryan Hill (May 03)
  • Re: Snort IGNORES var HOME_NET Vadim Pushkin (May 07)
    • Re: Snort IGNORES var HOME_NET Erek Adams (May 07)
  • Re: Snort IGNORES var HOME_NET Vadim Pushkin (May 08)
  • Re: Snort IGNORES var HOME_NET Matt Kettler (May 08)
  • Re: Snort IGNORES var HOME_NET Vadim Pushkin (May 08)
• HP-UX and snort still crashed Karl Lovink (May 03)
• remove Tarek Rached (May 03)
  • Re: remove Erek Adams (May 03)
• RE: Snort, MySQL, Acid Tom Sevy (May 03)
  • <Possible follow-ups>
  • Snort, MySQL, Acid Redman, Ken (May 03)
    • Re: Snort, MySQL, Acid Tim Sailer (May 03)
      • Re: Snort, MySQL, Acid Anton A. Chuvakin (May 06)
      • Re: Snort, MySQL, Acid Tim Sailer (May 06)
  • RE: Snort, MySQL, Acid Whaley, Mike (May 06)
    • Re: Snort, MySQL, Acid Ian Macdonald (May 07)
      • Re: Snort, MySQL, Acid Ian Macdonald (May 07)
  • RE: Snort, MySQL, Acid Whaley, Mike (May 06)
  • RE: Snort, MySQL, Acid Whaley, Mike (May 07)
  • snort, mysql, acid C White (Jun 13)
• As a newbie, two questions Emanuele Salvador (May 03)
  • Re: As a newbie, two questions Erek Adams (May 03)
  • <Possible follow-ups>
  • RE: As a newbie, two questions McCammon, Keith (May 03)
    • Re: As a newbie, two questions Emanuele Salvador (May 03)
  • RE: As a newbie, two questions McCammon, Keith (May 03)
• No logging from localhost? Whaley, Mike (May 03)
  • Re: No logging from localhost? Erek Adams (May 03)
• Help with tcpdump log rotation Rob Hughes (May 03)
  • Re: Help with tcpdump log rotation Eric Garnel (May 03)
  • Re: Help with tcpdump log rotation Anton A. Chuvakin (May 09)
    • Re: Help with tcpdump log rotation Rob Hughes (May 09)
      • Re: Help with tcpdump log rotation Erek Adams (May 10)
      • Re: Help with tcpdump log rotation Rob Hughes (May 10)
      • Re: Help with tcpdump log rotation John Sage (May 11)
• RE: Alerting Snort (sending alert through pager) Wirth, Jeff (May 03)
  • RE: Alerting Snort (sending alert through pager) Alwin Raymundo (May 06)
• Compiling snort AlinC (May 03)
• CONFIGURING SNORT TO USE MYSQL bfindley (May 03)
  • Re: CONFIGURING SNORT TO USE MYSQL Bruno Taranto (May 03)
• Detecting tunnels? Mark Horn (May 03)
  • Re: Detecting tunnels? Chris Green (May 03)
    • Re: Detecting tunnels? Mark Horn (May 05)
• Remote GUI Leandro A Ferreira (May 03)
  • Re: Remote GUI Erek Adams (May 03)
• Demarc (PureSecure) Noller, Gregory (May 03)
  • <Possible follow-ups>
  • Re: Demarc (PureSecure) Vadim Pushkin (May 06)
  • RE: Demarc (PureSecure) Omolayo Salako (May 06)
• RE: snortconf via web Tom Sevy (May 03)
  • Re: snortconf via web Michael Scheidell (May 05)
    • Re: snortconf via web ed (May 05)
    • Re: snortconf via web J. Craig Woods (May 05)
  • <Possible follow-ups>
  • RE: snortconf via web Dell, Jeffrey (May 03)
  • RE: snortconf via web Bob Walder (May 04)
• VoIP, Internet Telephony Traffic rms (May 03)
• configuring snort 1.8.x on windows 2000 pro.. noorulsadiqin azbiya (May 04)
  • RE: configuring snort 1.8.x on windows 2000 pro.. Michael Steele (May 04)
• packet generator noorulsadiqin azbiya (May 04)
  • Re: packet generator ScotScot (May 04)
• newbie: merging rulesets Rodney Kanno (May 05)
  • RE: newbie: merging rulesets Jeff Dell (May 05)
• DSL Monitoring Darren Young (May 05)
  • Re: [despammed] DSL Monitoring Ed McMan (May 05)
• Oinkmaster v0.5 Andreas Östling (May 06)
• Tap -> Hub Problem. larosa, vjay (May 06)
  • Re: Tap -> Hub Problem. Chris Green (May 06)
  • <Possible follow-ups>
  • RE: Tap -> Hub Problem. larosa, vjay (May 06)
  • RE: Tap -> Hub Problem. larosa, vjay (May 06)
• weird behaviour with Puresecure Omolayo Salako (May 06)
  • <Possible follow-ups>
  • RE: weird behaviour with Puresecure Ryan Hill (May 06)
  • FW: RE: weird behaviour with Puresecure Ryan Hill (May 07)
• Specifying SNMP Traps. larosa, vjay (May 06)
• Price for "vanilla Snort" (no bells and whistles) Glenn Larsson (May 06)
  • Re: Price for "vanilla Snort" (no bells and whistles) dr.kaos (May 06)
    • Re: Price for "vanilla Snort" (no bells and whistles) Glenn Larsson (May 07)
      • Semi-OT: GPL and Snort--Was Cost of Vanilla Snort Erek Adams (May 07)
    • Re: Price for "vanilla Snort" (no bells and whistles) Martin Roesch (May 07)
      • Re: Price for "vanilla Snort" (no bells and whistles) dr.kaos (May 08)
      • Re: Price for "vanilla Snort" (no bells and whistles) Martin Roesch (May 08)
• Acid Graphing cbumpste (May 06)
• Re: registered services John Sage (May 06)
• More on the "BAD TRAFFIC udp port 0" front Jason Haar (May 06)
• AW: Price for "vanilla Snort" (no bells and whistle s) Poppi, Sandro (May 06)
  • Re: AW: Price for "vanilla Snort" (no bells and whistle s) dr.kaos (May 07)
• Compile errors in Snort 1.8.6 with flexresp Baxter, John (May 07)
  • Re: Compile errors in Snort 1.8.6 with flexresp Chris Green (May 07)
  • <Possible follow-ups>
  • RE: Compile errors in Snort 1.8.6 with flexresp Baxter, John (May 07)
• Logfile Problem kai . hanisch (May 07)
• mysql.sock - where? Thomas Springer (May 07)
• IP-Field logging: Padding ? Andreas Czerniak (May 07)
• IRC - BOT networks: RULES ? Brian Ertel (May 07)
• AW: mysql.sock - where? Poppi, Sandro (May 07)
• ruletype directive doesn't work: why? Anton Chuvakin (May 07)
• Current Attack... Vadim Pushkin (May 07)
• Possible Snort bug. Glenn Larsson (May 07)
• running a script when a match is found Lookman Fazal (May 07)
  • Re: running a script when a match is found Michael Boman (May 07)
    • Re: running a script when a match is found Frank Knobbe (May 07)
• Pass rules?? R . Janaki (May 07)
  • Re: Pass rules?? Roberto Suarez Soto (May 09)
• ACID default sort order John Sage (May 07)
  • <Possible follow-ups>
  • Re: ACID default sort order Vadim Pushkin (May 08)
• RE: REMOVE Jason Haar from the list! Fallon, Benjamin (May 07)
• Semi-OT: Developer Thanks? Erek Adams (May 07)
• [Fwd: Re: REMOVE Jason Haar from the list!] Martin Forest (May 07)
• AW: Pass rules?? Poppi, Sandro (May 07)
• Detecting benchmarks Pawel Rogocz (May 08)
  • Re: Detecting benchmarks Erek Adams (May 08)
    • Re: Detecting benchmarks Pawel Rogocz (May 08)
      • Re: Detecting benchmarks Erek Adams (May 08)
      • Re: Detecting benchmarks Pawel Rogocz (May 10)
      • Re: Detecting benchmarks Erek Adams (May 10)
• Re: Snort-users digest, Vol 1 #1861 - 13 msgs Glenn Larsson (May 08)
  • Re: Re: Snort-users digest, Vol 1 #1861 - 13 msgs Chris Green (May 08)
• DOS MSDTC attempt false positive Kenny D (May 08)
  • Re: DOS MSDTC attempt false positive Matt Kettler (May 08)
    • Re: DOS MSDTC attempt false positive Kenny D (May 08)
  • Re: DOS MSDTC attempt false positive Roberto Suarez Soto (May 09)
  • Re: DOS MSDTC attempt false positive Bill McCarty (May 10)
    • Re: DOS MSDTC attempt false positive Matt Kettler (May 11)
    • Re: DOS MSDTC attempt false positive Matt Kettler (May 11)
      • Re: DOS MSDTC attempt false positive Bill McCarty (May 11)
• barnyard question? Omolayo Salako (May 08)
• Remove sensor from Mysql using ACID Hall, Duane (May 08)
• Proper Method and/or Place to Declare HTTP_SERVERS port? Vadim Pushkin (May 08)
  • Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Erek Adams (May 08)
  • Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Matt Kettler (May 08)
  • <Possible follow-ups>
  • Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Vadim Pushkin (May 08)
    • Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Erek Adams (May 08)
  • Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Vadim Pushkin (May 09)
• HP Printing Dan Fiorito (May 08)
  • Re: HP Printing Erek Adams (May 08)
• RE: Proper Method and/or Place to Declare HTTP_SERV ERS port? Kreimendahl, Chad J (May 09)
• Remote Syslog John Maestrale (May 09)
  • Re: Remote Syslog dr.kaos (May 09)
  • <Possible follow-ups>
  • RE: Remote Syslog Michael Steele (May 09)
    • Sensor automated signature updates Guy Bruneau (May 24)
  • Remote Syslog Russell Fulton (May 09)
  • RE: Remote Syslog Rich Adamson (May 10)
• riddle me this.... larosa, vjay (May 09)
• snort, mysql Duplicate entry Clay Caviness (May 09)
• Re:Snort & Cisco Catalyst ISL limbo (May 09)
• SYN flood detection Pawel Rogocz (May 10)
  • Re: SYN flood detection Matt Kettler (May 10)
    • Re: SYN flood detection Erek Adams (May 10)
      • Re: SYN flood detection Pawel Rogocz (May 10)
      • Re: SYN flood detection Erek Adams (May 10)
• Looking for tool to generate isp/domain notification emails.... Kevin Riggins (May 10)
  • Re: Looking for tool to generate isp/domain notification emails.... René Bellora (May 10)
  • Re: Looking for tool to generate isp/domain notification emails.... James Hoagland (May 11)
• RE: Looking for tool to generate isp/domain notific ation emails.... Potts, Ross A. (May 10)
  • Re: [despammed] RE: Looking for tool to generate isp/domain notific ation emails.... Ed McMan (May 10)
• Dynamically loading/unloading pre-processors... Ashley Thomas (May 10)
  • Re: Dynamically loading/unloading pre-processors... Erek Adams (May 10)
• sneeze.pl larosa, vjay (May 10)
• Converting data_payload to a readable format Jose Luis Onis (May 10)
• Snort output Tommy Tsilalis (May 10)
  • Re: Snort output Matt Kettler (May 10)
• modprobe error in log... Bob Hillegas (May 10)
  • <Possible follow-ups>
  • Re: modprobe error in log... Matt Kettler (May 11)
    • Re: modprobe error in log... Bob Hillegas (May 13)
  • RE: modprobe error in log... McClure Gammon (May 13)
• No more -z all? Rob Hughes (May 11)
  • Re: No more -z all? Alberto Dainotti (May 11)
    • Re: No more -z all? Rob Hughes (May 11)
      • Re: No more -z all? Rob Hughes (May 12)
      • Re: No more -z all? Jeff Nathan (May 12)
      • Re: No more -z all? Jeff Nathan (May 13)
• stupid question steven garrett (May 11)
• Another question Tommy Tsilalis (May 11)
  • Re: Another question Ashley Thomas (May 11)
• Bad Priority Error mailinglists (May 11)
  • Re: Bad Priority Error Matt Kettler (May 11)
• Ignore certain packets R . Janaki (May 11)
• "id command attempt" malformed packet Abe Wagner (May 11)
• ACID slow to bring up packet details - running on W2K with MS-SQL 2000 SP2 Brian Van Benschoten (May 11)
  • Re: ACID slow to bring up packet details - running on W2K with MS-SQL 2000 SP2 Andreas Hasenack (May 13)
• Excluding hosts from spp_unicode John Bradberry (May 11)
• Future features??? Paul . Fiero (May 11)
  • Re: Future features??? Wayne T Work (May 12)
    • Re: [despammed] Re: Future features??? Ed McMan (May 12)
  • <Possible follow-ups>
  • Re: Future features??? counter . spy (May 12)
  • RE: Future features??? larosa, vjay (May 12)
• Shellcode.rules fatal error? Ed Kasky (May 12)
  • <Possible follow-ups>
  • Re: Shellcode.rules fatal error? piotr . bulczak (May 12)
    • Re: Shellcode.rules fatal error? Matt Kettler (May 12)
  • Re: Shellcode.rules fatal error? ed (May 12)
• NIDS newbie question Concordio M. Pajayat, Jr. (May 12)
• ADdRules dareen (May 12)
  • Re: ADdRules Matt Kettler (May 12)
• Output questionduring FIN scan Tommy Tsilalis (May 12)
  • Re: Output question during FIN scan Matt Kettler (May 12)
• spp_portscan and mysql Mikael Chambon (May 12)
  • <Possible follow-ups>
  • RE: spp_portscan and mysql Wirth, Jeff (May 13)
    • Re: spp_portscan and mysql Mikael Chambon (May 13)
• AW: Future features??? Poppi, Sandro (May 12)
• String matching in snort. Ashley Thomas (May 12)
  • <Possible follow-ups>
  • Re: String matching in snort. Matt Kettler (May 12)
    • Re: String matching in snort. C. Jason Coit (May 18)
• configuration error the 1st time running acid (asap) noorulsadiqin azbiya (May 12)
• AW: [Barnyard-users] NIDS newbie question Poppi, Sandro (May 12)
• daemon consuming 100% memory kukulkan (May 12)
  • Re: daemon consuming 100% memory Chris Green (May 13)
  • Re: daemon consuming 100% memory Matt Kettler (May 13)
• FAQ update regarding -z Jeff Nathan (May 13)
• Off topic: Thousands of traceroutes ? Tudor Panaitescu (May 13)
  • <Possible follow-ups>
  • RE: Off topic: Thousands of traceroutes ? Spitzer, Nathan (May 13)
  • Re: Off topic: Thousands of traceroutes ? Tudor Panaitescu (May 13)
  • Re: Off topic: Thousands of traceroutes ? Tudor Panaitescu (May 13)
    • Re: Re: Off topic: Thousands of traceroutes ? John Sage (May 13)
      • Re: Re: Off topic: Thousands of traceroutes ? Jeff Nathan (May 13)
  • Re: Off topic: Thousands of traceroutes ? Tudor Panaitescu (May 13)
    • Re: Re: Off topic: Thousands of traceroutes ? skill 's (May 13)
  • RE: Re: Off topic: Thousands of traceroutes ? Tudor Panaitescu (May 13)
    • Re: [despammed] RE: Re: Off topic: Thousands of traceroutes ? Ed McMan (May 13)
  • RE: Re: Off topic: Thousands of traceroutes ? Bob Walder (May 14)
    • Re: Re: Off topic: Thousands of traceroutes ? John Sage (May 14)
• snort and mysql Steven Garrett (May 13)
  • Re: snort and mysql John Sage (May 13)
• Signature for Snort 1.8.x Bastian Ballmann (May 13)
  • Re: Signature for Snort 1.8.x Andreas Östling (May 13)
• Snort + Demarc Remote logging? diwelf (May 13)
  • <Possible follow-ups>
  • RE: Snort + Demarc Remote logging? Ryan Hill (May 13)
• centralized log Ganu Skop (May 13)
  • Re: centralized log Risto Vaarandi (May 17)
• mysql Duplicate entry Clay Caviness (May 13)
• Snort crashes with binary log Paweł Goleń (May 13)
• Playing wavs or mp3 on intrusion detect Helderdp (May 13)
  • Re: Playing wavs or mp3 on intrusion detect Chris Green (May 13)
  • Re: Playing wavs or mp3 on intrusion detect F.M. Taylor (May 13)
    • OFF-TROPIC - Boot Disk Carlos Augusto Silva (May 13)
  • Re: Playing wavs or mp3 on intrusion detect John Sage (May 13)
  • Re: Playing wavs or mp3 on intrusion detect Jason Haar (May 13)
  • <Possible follow-ups>
  • RE: Playing wavs or mp3 on intrusion detect Hicks, John (May 14)
• Tivoli traps Leandro A Ferreira (May 13)
  • <Possible follow-ups>
  • Re: Tivoli traps Martin Forest (May 13)
  • Re: Tivoli traps piotr . bulczak (May 13)
• Snort loading at startup Ted Stringer (May 13)
  • <Possible follow-ups>
  • RE: Snort loading at startup Spitzer, Nathan (May 14)
  • RE: Snort loading at startup larosa, vjay (May 14)
  • RE: Snort loading at startup Ted Stringer (May 14)
  • RE: Snort loading at startup larosa, vjay (May 14)
  • RE: Snort loading at startup counter . spy (May 14)
    • RE: Snort loading at startup Ted Stringer (May 14)
• Snort not Log D'Amato Luigi (May 13)
• Snort Books doug.fee () unisys com (May 13)
• AW: Snort not Log Poppi, Sandro (May 14)
  • Re: Snort not Log D'Amato Luigi (May 14)
  • <Possible follow-ups>
  • AW: Snort not Log Poppi, Sandro (May 14)
• -i any ? Jev (May 14)
  • Re: -i any ? Erek Adams (May 14)
  • <Possible follow-ups>
  • RE: -i any ? McCammon, Keith (May 14)
• snort & db with a low speed connection Luca Tampieri (May 14)
• Converting Hex to Ascii in mysql Ian Macdonald (May 14)
• Snort in a switched environment Bastian Ballmann (May 14)
  • Re: Snort in a switched environment Justin M. Parker (May 14)
  • Re: Snort in a switched environment Erek Adams (May 14)
    • Re: Snort in a switched environment (Ignore this (Sorry, I have to make this test)) Edin Dizdarevic (May 15)
  • Re: Snort in a switched environment Bruno Taranto (May 15)
  • Re: Snort in a switched environment Scott McGee (May 15)
  • <Possible follow-ups>
  • Re: Snort in a switched environment Andrew . Zielinski (May 14)
  • RE: Snort in a switched environment McCammon, Keith (May 14)
  • RE: Snort in a switched environment Matt Yackley (May 14)
    • Re: Snort in a switched environment Bruno Taranto (May 15)
  • RE: Snort in a switched environment counter . spy (May 14)
  • Re: Snort in a switched environment Justin M. Parker (May 14)
  • Re: Snort in a switched environment Scott McGee (May 14)
  • RE: Snort in a switched environment Spitzer, Nathan (May 14)
  • Re: Snort in a switched environment Joe Pampel (May 15)
• RE: OFF-TROPIC - Boot Disk Hicks, John (May 14)
• ispy software (slightly off-topic) Paul . Simons (May 14)
• ACID and PHP G Saoutine (May 14)
  • Re: ACID and PHP F.M. Taylor (May 14)
  • <Possible follow-ups>
  • RE: ACID and PHP Steve Halligan (May 14)
• Problem getting Snort to Connect to PostgreSQL database Brian Hughes (May 14)
  • Re: Problem getting Snort to Connect to PostgreSQL database Alejandro Flores (May 15)
    • Re: Problem getting Snort to Connect to PostgreSQLdatabase Brian Hughes (May 15)
  • <Possible follow-ups>
  • Problem getting Snort to Connect to PostgreSQL database Brian Hughes (May 15)
    • Re: Problem getting Snort to Connect to PostgreSQL database Bruno Taranto (May 15)
    • Re: Problem getting Snort to Connect to PostgreSQL database Roberto Suarez Soto (May 16)
• SYSLOG John Maestrale (May 14)
  • <Possible follow-ups>
  • SYSLOG John Maestrale (May 15)
• Only testing... Edin Dizdarevic (May 14)
• Snort.conf question $HOME_NET Question V1.8.6 Rose, Jerry L SAJ Contractor (May 14)
  • <Possible follow-ups>
  • RE: Snort.conf question $HOME_NET Question V1.8.6 larosa, vjay (May 14)
• Schema from 1.83 to 1.86 Mike Shaw (May 14)
• xml plugin Juergen Fiedler (May 14)
  • What do these errors mean? Dan D. (May 14)
• bug in spp_http_decode.c Peng Yong (May 14)
• AW: Schema from 1.83 to 1.86 Poppi, Sandro (May 14)
• AW: What do these errors mean? Poppi, Sandro (May 14)
• AW: Snort loading at startup Poppi, Sandro (May 14)
• Multiple Content (not working?) Carlos Kumbak (May 15)
  • Re: Multiple Content (not working?) skill 's (May 15)
  • Re: Multiple Content (not working?) Matt Kettler (May 15)
    • Re: Multiple Content (not working?) F.M. Taylor (May 15)
  • <Possible follow-ups>
  • Re: Multiple Content (not working?) Carlos Kumbak (May 16)
    • Re: Multiple Content (not working?) F.M. Taylor (May 17)
• Portscan false positives reg. DNS caching server Reckhard, Tobias (May 15)
• switch Alwin Raymundo (May 15)
  • Re: switch Edin Dizdarevic (May 15)
  • <Possible follow-ups>
  • RE: switch Don McEachern (May 15)
    • Re: switch Leigh David Heyman (May 15)
  • RE: switch counter . spy (May 15)
• snortsam Ralf Hildebrandt (May 15)
• switch? for what? Bruno Taranto (May 15)
  • RE: switch? for what? Weber Mail (May 15)
• AW: switch Poppi, Sandro (May 15)
• snort and firewall Stephan Helas (May 15)
• SNORT newbie looking for some help with Snort on Win2k Richard Roy (May 15)
  • <Possible follow-ups>
  • RE: SNORT newbie looking for some help with Snort on Win2k McCammon, Keith (May 15)
  • RE: SNORT newbie looking for some help with Snort on Win2k Michael Steele (May 16)
• RE: SNORT newbie looking for some help with Snort o n Win2k Slighter, Tim (May 15)
  • <Possible follow-ups>
  • RE: SNORT newbie looking for some help with Snort o n Win2k Richard Roy (May 16)
• Where can i get Swatch? Kenny D (May 15)
  • RE: Where can i get Swatch? Wayne T Work (May 15)
  • <Possible follow-ups>
  • RE: Where can i get Swatch? McCammon, Keith (May 15)
• Problem graphing in ACID w/Snort Cloppert, Michael (May 15)
• Help with monitoring sending packet rate Tu Nguyen (May 15)
  • <Possible follow-ups>
  • RE: Help with monitoring sending packet rate Spitzer, Nathan (May 15)
    • RE: Help with monitoring sending packet rate Tu Nguyen (May 15)
• Viewing MySql Archive with Acid Ed Kasky (May 15)
• Upgrading DB schema Karen Marino (May 15)
  • <Possible follow-ups>
  • RE: Upgrading DB schema larosa, vjay (May 15)
• snortrules.tar.gz Devon Harding - GTHLA (May 15)
  • <Possible follow-ups>
  • RE: snortrules.tar.gz MOHESOWA BYAS (May 15)
• snort with acid Richard Roy (May 15)
• PureSecure 1.6 Ed Chen (May 15)
  • Re: PureSecure 1.6 Ian Macdonald (May 15)
  • <Possible follow-ups>
  • RE: PureSecure 1.6 Ryan Hill (May 15)
• demarc: validate Devon Harding - GTHLA (May 15)
  • <Possible follow-ups>
  • RE: demarc: validate larosa, vjay (May 15)
  • RE: demarc: validate Ryan Hill (May 15)
  • RE: demarc: validate Ryan Hill (May 15)
  • RE: demarc: validate Devon Harding - GTHLA (May 15)
• ACID Problem John Hally (May 15)
  • Re: ACID Problem Alex Pinheiro Machado Rodrigues (May 15)
  • <Possible follow-ups>
  • Re: ACID Problem Piotr Bulczak (May 15)
  • RE:ACID Problem counter . spy (May 16)
  • RE: ACID Problem Fallon, Benjamin (May 16)
• Snort Log Despoofer Glenn Larsson (May 15)
  • Re: Snort Log Despoofer ScotScot (May 15)
    • Re: Snort Log Despoofer Glenn Larsson (May 16)
      • Re: Snort Log Despoofer Chris Green (May 16)
• Rough Draft: Upgrading Snort Erek Adams (May 15)
• Attention WINDOWS Users! Latest Snort 1.87b119 Binaries Available NOW! Michael Steele (May 15)
• AW: Viewing MySql Archive with Acid Poppi, Sandro (May 15)
• AW: Upgrading DB schema Poppi, Sandro (May 15)
• Rép. : [Snort-users] demarc: validate Ronald Beaulieu (May 16)
  • Re: [Snort-users] Rép. : [Snort-users] demarc: validate Ian Macdonald (May 16)
• another switch question Alwin Raymundo (May 16)
  • Re: another switch question Jose Luis Medina (May 16)
• AW: another switch question Poppi, Sandro (May 16)
  • Re: AW: another switch question Alwin Raymundo (May 16)
• Re: Snort-users digest, Vol 1 #1890 - 10 msgs Glenn Larsson (May 16)
• snort exit Steven Garrett (May 16)
  • <Possible follow-ups>
  • RE: snort exit McCammon, Keith (May 16)
  • RE: snort exit Steven Garrett (May 16)
  • RE: snort exit Steven Garrett (May 16)
  • RE: snort exit Steven Garrett (May 16)
• Offtopic - Snort packet stats bthaler (May 16)
  • <Possible follow-ups>
  • RE: Offtopic - Snort packet stats BShinn (May 16)
    • Re: [despammed] RE: Offtopic - Snort packet stats Ed McMan (May 16)
• SnortSnarf version 020516.1 now available James Hoagland (May 16)
• Attention WINDOWS Users: Latest 1.87b119 Binaries Available Michael Steele (May 16)
• blocking Ganu Skop (May 16)
  • Re: blocking Martin Forest (May 16)
• RE: Snort packet stats BShinn (May 16)
• Fine-tuning a rule Shane Hickey (May 17)
  • Re: Fine-tuning a rule Michael Scheidell (May 17)
• running 2 instances of snort under Demarc SkatFiend (May 17)
  • <Possible follow-ups>
  • running 2 instances of snort under Demarc Steven Williams (May 19)
  • Re: running 2 instances of snort under Demarc SkatFiend (May 23)
• NIDS in switched environments counter . spy (May 18)
• Managing large IDS deployments (SecurityFocus) Moyer, Shawn (May 18)
• Snort rule for detecting wireless 802.11b transmissions Alan_Kloster (May 18)
• Don't see traffic unless have IP Jhumri Tilayia (May 18)
  • Re: Don't see traffic unless have IP Glenn Forbes Fleming Larratt (May 18)
    • Re: Don't see traffic unless have IP Ian Macdonald (May 22)
• -B option Lance Spitzner (May 18)
  • Re: -B option John Sage (May 18)
• Invalid Sig ID ESR (May 19)
• Automating Sensor Installation Darren Young (May 19)
  • Re: Automating Sensor Installation Demetri Mouratis (May 19)
  • cavo stealth D'Amato Luigi (May 20)
    • Re: cavo stealth John Sage (May 20)
• barnyard status? Michael Scheidell (May 19)
• patch to reference.config? Michael Scheidell (May 19)
  • <Possible follow-ups>
  • Re: patch to reference.config? Roman Danyliw (May 19)
• snort configuration using gui... Ashley Thomas (May 19)
  • RE: snort configuration using gui... Patrick Harper (May 19)
  • RE: snort configuration using gui... Robert S. (May 19)
  • <Possible follow-ups>
  • RE: snort configuration using gui... Fallon, Benjamin (May 20)
    • RE: snort configuration using gui... Jeff Dell (May 20)
    • Re: snort configuration using gui... Cedric Guillotin (May 21)
  • RE: snort configuration using gui... McGuire, Barrett (May 20)
• Weird issue with 1.8.6 and SMTP alerts Jason Haar (May 19)
  • Re: Weird issue with 1.8.6 and SMTP alerts Rob Hughes (May 21)
• Excluding $HOME_NET -> $HOME_NET Alerts Ed Kasky (May 19)
  • Re: Excluding $HOME_NET -> $HOME_NET Alerts Michael Boman (May 19)
    • Re: Excluding $HOME_NET -> $HOME_NET Alerts Ed Kasky (May 19)
      • Re: Excluding $HOME_NET -> $HOME_NET Alerts Michael Boman (May 19)
      • Re: Excluding $HOME_NET -> $HOME_NET Alerts Ed Kasky (May 20)
      • Re: Excluding $HOME_NET -> $HOME_NET Alerts Michael Boman (May 20)
• How to configure Logwatch Kenny D (May 20)
• AW: Automating Sensor Installation Poppi, Sandro (May 20)
• limiting memory usage Steven Garrett (May 20)
• Snort comparisons Tim Prendergast (May 20)
  • <Possible follow-ups>
  • Re: Snort comparisons Piotr Bulczak (May 20)
  • RE: Snort comparisons McCammon, Keith (May 20)
  • RE: Snort comparisons Cavey, Mark A. (May 20)
• Win32 Port of Snort Michael J Worden (May 20)
  • <Possible follow-ups>
  • RE: Win32 Port of Snort McCammon, Keith (May 20)
    • Re: Win32 Port of Snort Chris Reid (May 20)
    • RE: Win32 Port of Snort Michael Steele (May 20)
• Testing Snort Darren Young (May 20)
  • <Possible follow-ups>
  • RE: Testing Snort Potts, Ross A. (May 21)
  • testing snort john (Jun 14)
  • Re: testing snort counter . spy (Jun 16)
• Highlighting an IP address in an alert/log Peter Bates (May 21)
• [ANN] MacNIDS Nick Zitzmann (May 21)
• AW: [ANN] MacNIDS Poppi, Sandro (May 21)
• Alerts with Snort Brad Lisoweski (May 21)
  • RE: Alerts with Snort bthaler (May 21)
  • <Possible follow-ups>
  • RE: Alerts with Snort Steve Halligan (May 21)
• Tagging and Acid Andreas Hasenack (May 21)
• New version: Snort Log Despoofer. Glenn Larsson (May 21)
• 2 questions: Timeformat + ARP Despoofing. Glenn Larsson (May 21)
• Getting MYSQL support compiled Cooper Arthur B Contr WCOM (May 21)
  • Re: Getting MYSQL support compiled Erek Adams (May 21)
  • Re: Getting MYSQL support compiled Ted Stringer (May 21)
• overlapping fragments Ashley Thomas (May 21)
• Strange mail problem Martin Forest (May 21)
  • Re: Strange mail problem Martin Forest (May 21)
• SQLsnake - any able to create a sig for this one? john (May 21)
  • Re: SQLsnake - any able to create a sig for this one? Roberto Suarez Soto (May 22)
    • Re: SQLsnake - any able to create a sig for this one? Matt Kettler (May 22)
  • <Possible follow-ups>
  • SQLsnake - any able to create a sig for this one? john (May 21)
  • Re: SQLsnake - any able to create a sig for this one? counter . spy (May 22)
• RE: [Snort-sigs] SQLsnake - any able to create a sig for this one ? larosa, vjay (May 21)
• AW: Alerts with Snort Poppi, Sandro (May 21)
• Hardware Questions SkatFiend (May 22)
  • Re: Hardware Questions Rich Adamson (May 22)
• snort not logging to database Devon Harding - GTHLA (May 22)
  • <Possible follow-ups>
  • snort not logging to database Devon Harding - GTHLA (May 22)
  • RE: snort not logging to database Estes, Matt CPR / FCBS (May 22)
  • RE: snort not logging to database Devon Harding - GTHLA (May 22)
• Preventing Cyberattacks Webcast Joe Magee (May 22)
• Wireless monitoring Mitchell Henderson (May 22)
  • Re: Wireless monitoring Greg Robinson (May 22)
    • Re: Wireless monitoring Alex Pinheiro Machado Rodrigues (May 22)
  • <Possible follow-ups>
  • RE: Wireless monitoring Spitzer, Nathan (May 22)
• 1.8.6 and tcpdump format Jeremy (May 22)
  • Re: 1.8.6 and tcpdump format Erek Adams (May 22)
  • <Possible follow-ups>
  • RE: 1.8.6 and tcpdump format Slighter, Tim (May 22)
• Barnyard dumps core when using acid_log (but not acid_alert) M. Toren (May 22)
• Rule to log Instant Messaging connections Spy Guy (May 22)
• spp_portscan behavior is 1.8.6 Ryan Hill (May 22)
  • Re: spp_portscan behavior is 1.8.6 Edwin Eefting (May 23)
• Snort with -b option and alerts to syslog.. C Boss (May 22)
• Connecting snort bidirectionnal. Patrice . Arnal (May 23)
  • Re: Connecting snort bidirectionnal. Jeff Nathan (May 23)
• AW: Connecting snort bidirectionnal. Poppi, Sandro (May 23)
• not logging portscans Fage Martin (May 23)
  • Re: not logging portscans Matt Kettler (May 23)
  • <Possible follow-ups>
  • RE: not logging portscans McCammon, Keith (May 23)
• compilation problem for mySQL tech (May 23)
• snort email alert Math (May 23)
  • Re: snort email alert Matt Kettler (May 23)
• 2 NICS John Maestrale (May 23)
  • Re: 2 NICS Ian Macdonald (May 23)
  • <Possible follow-ups>
  • RE: 2 NICS Tom McComb (May 23)
• ACID help Michael S. Boyd (May 23)
  • <Possible follow-ups>
  • RE: ACID help Brad Lisoweski (May 23)
  • RE: ACID help Michael S. Boyd (May 23)
• spp_stream4 alerts "un-disable-able" ? :-) Edwin Eefting (May 23)
  • Re: spp_stream4 alerts "un-disable-able" ? :-) Chris Green (May 23)
• alert by email. Carles Xavier Munyoz Baldó (May 23)
• Snort upgrade Hugo Ferr (May 23)
• 2 more questions: Glenn Larsson (May 23)
  • Message not available
    • Re: 2 more questions: Glenn Larsson (May 23)
      • Re: 2 more questions: Tim Prendergast (May 23)
  • Re: 2 more questions: Jeff Nathan (May 23)
• logging to remote syslog Ronneil Camara (May 23)
  • Re: logging to remote syslog Ted Stringer (May 23)
  • <Possible follow-ups>
  • RE: logging to remote syslog Keith Pachulski (May 23)
  • RE: logging to remote syslog Ronneil Camara (May 23)
• Too many events in logs spyguy703 (May 23)
  • <Possible follow-ups>
  • Re: Too many events in logs Matt Kettler (May 23)
• Cron Script Schlotterer, Matthew (May 23)
  • <Possible follow-ups>
  • RE: Cron Script McCammon, Keith (May 23)
• CSV Output problems... Glenn Larsson (May 23)
• FYI: New ucd agent && snort !good Rob Hughes (May 23)
• AW: alert by email. Poppi, Sandro (May 23)
• AW: Cron Script Poppi, Sandro (May 23)
• Snort reports, PureSecure Jari Pirhonen (May 24)
• AW: spp_portscann don't work Poppi, Sandro (May 24)
• spp_portscann don't work Stephan Helas (May 24)
• ignore ping Jim Williams (May 24)
  • Re: ignore ping Roberto Suarez Soto (May 27)
• 1.8.6 RPMS?? Kristopher Czachor (May 24)
  • RE: 1.8.6 RPMS?? Kristopher Czachor (May 30)
    • Re: 1.8.6 RPMS?? Chris Green (May 30)
      • Re: 1.8.6 RPMS?? Mark Wormgoor (May 30)
• Regarding latest snort rules. Ashley Thomas (May 24)
• Same question again.. C Boss (May 25)
  • Re: Same question again.. John Sage (May 25)
  • Re: Same question again.. Bamm Visscher (May 25)
  • Re: Same question again.. Erek Adams (May 25)
  • <Possible follow-ups>
  • Re: Same question again.. C Boss (May 29)
    • Re: Same question again.. Erek Adams (May 28)
• where can I find Ntwdblib.dll y q (May 25)
• No UDP by nmap scan tino . brandt (May 25)
• Not Compiled for MySQL Matt Richter (May 25)
  • Re: Not Compiled for MySQL John Sage (May 25)
• Mandrake 8.2 laurent didier (May 26)
  • Re: Mandrake 8.2 John Sage (May 26)
• Tap traffic reassembly using OpenBSD bridge? Douglas (May 26)
• Re: Snort-users digest, Vol 1 #1914 - 6 msgs john (May 26)
• new function and references in sql tech (May 26)
• SETTING UP SNORT Somak S (May 27)
  • <Possible follow-ups>
  • RE: SETTING UP SNORT Hicks, John (May 27)
• Rép. : Re: [Snort-users] running 2 instances of snort under Demarc Ronald Beaulieu (May 27)
• Barnyard 0.1.0 beta5 released Andrew R. Baker (May 27)
• Stubbourn Pcap Error Hicks, John (May 27)
  • Re: Stubbourn Pcap Error Chris Reid (May 27)
  • <Possible follow-ups>
  • Re: Stubbourn Pcap Error CJATeck (May 27)
• snortpp missing? Michael Scheidell (May 27)
  • Re: snortpp missing? John Sage (May 27)
• barnyard-0.1.0-beta5 and mysql Michael Scheidell (May 27)
  • Re: barnyard-0.1.0-beta5 and mysql Andrew R. Baker (May 27)
• [Re: snortpp missing?: Mail System Error - Returned Mail] John Sage (May 27)
• upgrade Hugo Ferr (May 27)
• Barnyard 0.1.0 beta6 released Andrew R. Baker (May 27)
• What's the fuss about string matching ? Pawel Rogocz (May 27)
  • Re: What's the fuss about string matching ? Jason Haar (May 27)
  • Re: What's the fuss about string matching ? Andreas Östling (May 27)
  • Re: What's the fuss about string matching ? Frank Knobbe (May 28)
• Portscan not logging Ed Kasky (May 27)
  • Re: Portscan not logging Mike Macias (May 28)
    • Re: Portscan not logging ed (May 28)
    • Re: Portscan not logging Ed Kasky (May 28)
• Logging Problem Stephan Helas (May 28)
• snort 1.87beta5 still holds some fds on HUP Michael Scheidell (May 28)
• cannot compile snort on Freebsd 4.5 or 4.6 from cvs.....snort 1.8.6 compiles ok Mark Rowlands (May 28)
  • Re: cannot compile snort on Freebsd 4.5 or 4.6 from cvs.....snort 1.8.6 compiles ok Chris Green (May 28)
  • Re: cannot compile snort on Freebsd 4.5 or 4.6 from cvs.....snort 1.8.6 compiles ok Rob Hughes (May 28)
• RE: SSL CodeRed et al Sean T. Ballard (May 28)
  • RE: SSL CodeRed et al bthaler (May 28)
  • <Possible follow-ups>
  • SSL CodeRed et al bthaler (May 28)
    • Re: SSL CodeRed et al Ryan Russell (May 28)
    • Re: SSL CodeRed et al Phil Wood (May 28)
  • RE: SSL CodeRed et al East, Bill (May 28)
    • RE: SSL CodeRed et al Frank Knobbe (May 28)
      • RE: SSL CodeRed et al bthaler (May 28)
  • RE: SSL CodeRed et al Jim Grossl (May 28)
  • RE: SSL CodeRed et al Wilcoxon, Steve (May 29)
• Bonding - has anyone gotten it to work with an ether tap quentyn (May 28)
• sorry...upgrade question again Hugo Ferr (May 28)
  • Re: sorry...upgrade question again Erek Adams (May 28)
    • Re: sorry...upgrade question again Hugo Ferr (May 29)
      • RE: sorry...upgrade question again Adam Migus (May 29)
      • Re: sorry...upgrade question again Hugo Ferr (May 30)
      • q about alerts Weber Mail (May 30)
      • Re: q about alerts Phil Wood (May 31)
• snort signatures on www.snort.org Russell Fulton (May 28)
• (ot) how to get alert size? mel (May 28)
  • RE: (ot) how to get alert size? Abe L. Getchell (May 28)
• AW: Bonding - has anyone gotten it to work with an ether tap Poppi, Sandro (May 28)
  • alert Mr. F Phat's (May 29)
  • Re: AW: Bonding - has anyone gotten it to work with an ether tap quentyn (May 29)
• Alpha4 Accounty Mike Meredith (May 29)
• How to Craft a rule that negates multiple ports?? Alan_Kloster (May 29)
  • Re: How to Craft a rule that negates multiple ports?? Michael Scheidell (May 29)
• acid and udp ports Jason Yates (May 29)
• Snort doesnt detect traffic. Magnus.M.Glantz (May 29)
  • Re: Snort doesnt detect traffic. Erek Adams (May 29)
  • <Possible follow-ups>
  • SV: Snort doesnt detect traffic. Magnus.M.Glantz (May 30)
    • Re: SV: Snort doesnt detect traffic. Erek Adams (May 30)
  • SV: SV: Snort doesnt detect traffic. Magnus.M.Glantz (May 31)
    • Re: SV: SV: Snort doesnt detect traffic. Erek Adams (May 30)
• Bandwidth Information Cooper Arthur B Contr WCOM (May 29)
  • Re: Bandwidth Information Erek Adams (May 29)
  • <Possible follow-ups>
  • RE: Bandwidth Information Spitzer, Nathan (May 29)
  • RE: Bandwidth Information Kreimendahl, Chad J (May 29)
• Snort > mysql > acid - timestamp troubles Rose, Jerry L SAJ Contractor (May 29)
  • Re: [despammed] Snort > mysql > acid - timestamp troubles Ed McMan (May 30)
• AW: Snort > mysql > acid - timestamp troubles Poppi, Sandro (May 30)
• AW: (no subject) Poppi, Sandro (May 30)
  • <Possible follow-ups>
  • AW: (no subject) Poppi, Sandro (Jun 04)
• AW: Same question again.. Poppi, Sandro (May 30)
• Firewall Tester 0.7 Andrea Barisani (May 30)
• Constantly displaying the event on the console Chang, Andre (May 30)
  • RE: Constantly displaying the event on the console bthaler (May 30)
• help Lance Barisdale (May 30)
  • <Possible follow-ups>
  • Help greg (Jun 11)
    • Re: Help Erek Adams (Jun 11)
• Attention: Win32 Users - Snort 1.8.6b121 Ready - W/Run As Service Michael Steele (May 30)
• RE: Attention: Win32 Users - Snort 1.8.6b121 Ready - W/Run As Service Hicks, John (May 30)
• barnyard over TCP Michael Anderson (May 30)
  • Re: barnyard over TCP Andrew R. Baker (May 31)
    • Re: barnyard over TCP Michael Anderson (May 30)
  • <Possible follow-ups>
  • RE: barnyard over TCP ChandlerH (May 30)
• snort + mysql dweise (May 30)
  • Re: snort + mysql Erek Adams (May 30)
• portscan Petriz, Pablo (May 30)
• flexresp on 1.8.6 with red hat 7.2 Hugo Ferr (May 30)
  • Re: flexresp on 1.8.6 with red hat 7.2 Chris Green (May 30)
    • Re: flexresp on 1.8.6 with red hat 7.2 Ryan Russell (May 30)
      • OT: Sourceforge (Was: Re: flexresp on 1.8.6 with red hat 7.2) Chris Green (May 31)
• shellcode error Hugo Ferr (May 30)
  • RE: shellcode error bthaler (May 30)
    • Re: shellcode error Hugo Ferr (May 30)
      • Re: shellcode error Erek Adams (May 30)
      • Re: shellcode error Hugo Ferr (May 31)
      • Re: shellcode error Erek Adams (May 31)
      • Re: shellcode error Hugo Ferr (May 31)
  • Re: shellcode error matt (May 30)
    • Re: shellcode error john (May 31)
      • Re: shellcode error Erek Adams (May 31)
      • Re: shellcode error Matt Kettler (May 31)
• schema version 104 Hugo Ferr (May 30)
  • <Possible follow-ups>
  • Re: schema version 104 roman (May 31)
  • Re: schema version 104 Hugo Ferr (May 31)
  • Re: schema version 104 roman (May 31)
  • Re: schema version 104 Hugo Ferr (May 31)
• excluding a host from rule Chang, Andre (May 30)
  • Re: excluding a host from rule Alex Pinheiro Machado Rodrigues (May 30)
    • Re: Re: excluding a host from rule Joe McAlerney (May 30)
  • RE: excluding a host from rule Don (May 31)
• Ignore ICMP ping Math (May 31)
  • Re: Ignore ICMP ping Joe McAlerney (May 31)
• Re: snort 1.87beta5 still holds some fds on HUP (fixed) Rob Hughes (May 31)
  • Re: snort 1.87beta5 still holds some fds on HUP(fixed) Michael Scheidell (Jun 01)
    • Re: snort 1.87beta5 still holds some fds on HUP(fixed) Rob Hughes (Jun 03)
• Snort & Prelude counter . spy (May 31)
  • <Possible follow-ups>
  • Re: Snort & Prelude Krzysztof Zaraska (Jun 02)
• Barnyard? Tom Sevy (May 31)
  • RE: Barnyard? bthaler (May 31)
• Snort Database and ODBC Clients Matt Richter (May 31)
• snort-stable-snapshot.tar.gz & snort-daily.tar.gz Slighter, Tim (May 31)
  • Re: snort-stable-snapshot.tar.gz & snort-daily.tar.gz James Hoagland (Jun 01)
• AW: Ignore ICMP ping Poppi, Sandro (May 31)
• AW: barnyard over TCP Poppi, Sandro (May 31)
• product description Hugo Ferr (May 31)
• some policy rules missing in 1.8.7 beta5? Michael Scheidell (May 31)
• RV: portscan Petriz, Pablo (May 31)
  • Re: RV: portscan Hugo Ferr (May 31)
  • <Possible follow-ups>
  • RE: RV: portscan Petriz, Pablo (Jun 03)
• Re: Snort-users digest, Vol 1 #1929 - 1 msg Joe Pampel (May 31)
• Compiling snort on Win32 Ian Macdonald (May 31)
  • Re: Compiling snort on Win32 Chris Reid (May 31)
    • RE: Compiling snort on Win32 Michael Steele (May 31)
      • Re: Compiling snort on Win32 Chris Reid (Jun 01)
      • RE: Compiling snort on Win32 Jason Withrow (Jun 02)
      • RE: Compiling snort on Win32 Frank Knobbe (Jun 03)
  • RE: Compiling snort on Win32 Don (May 31)
• Stable Snort Rules fails? Juan Pablo Villaverde (May 31)
  • Re: Stable Snort Rules fails? Erek Adams (May 31)
  • Message not available
    • Re: Stable Snort Rules fails? matt (Jun 01)
• Pretty Reports for Management Donna MacLeod (May 31)
  • Re: Pretty Reports for Management Mark Rowlands (May 31)
  • <Possible follow-ups>
  • Re: Pretty Reports for Management CJATeck (May 31)
• Email alert and porscan.log on a daily basis JEFF Collins (May 31)
  • RE: Email alert and porscan.log on a daily basis Don (Jun 01)
  • Re: Email alert and porscan.log on a daily basis matt (Jun 01)
• portscsan.log summary. Chris Keladis (May 31)
  • Re: portscsan.log summary. Phil Wood (Jun 01)
• Multiple IP Salvatore Basso (May 31)
  • Re: Multiple IP matt (Jun 01)
    • Re: Multiple IP Salvatore Basso (Jun 04)
      • Re: Multiple IP (ethernet switches vs hubs) Matt Kettler (Jun 03)
• Unix sockets Nick Zitzmann (Jun 01)
  • Re: Unix sockets Dr. Richard W. Tibbs (Jun 03)
• external_net and home_net questions thelupine (Jun 01)
  • RE: external_net and home_net questions Don (Jun 02)
• I'd rather not get the message Phil Wood (Jun 01)
  • Re: I'd rather not get the message John Sage (Jun 02)
  • Re: I'd rather not get the message matt (Jun 03)
  • <Possible follow-ups>
  • RE: I'd rather not get the message McCammon, Keith (Jun 03)
  • RE: I'd rather not get the message Jeff Anderson (Jun 04)
• Strange logging problem Ed McMan (Jun 02)
• Which rules to use for snort ? Ronald Nutter (Jun 02)
  • Re: Which rules to use for snort ? matt (Jun 03)
    • Rules troubles in startup Juan Pablo Villaverde (Jun 26)
      • Re: Rules troubles in startup steveg (Jun 26)
  • Re: Which rules to use for snort ? John Sage (Jun 03)
  • <Possible follow-ups>
  • RE: Which rules to use for snort ? Ronald Nutter (Jun 03)
• AW: external_net and home_net questions Poppi, Sandro (Jun 02)
• Tagging and Packet Payload Roshen Chandran (Jun 03)
  • Re: Tagging and Packet Payload Chris Green (Jun 03)
• A tool to Archive & delete mysql ( snortdb ) records .. K.S.NARAYANAN (Jun 03)
• Snort on Win32 Potts, Ross A. (Jun 03)
• RE: A tool to Archive & delete mysql ( snortdb ) re cords .. John Maestrale (Jun 03)
  • Re: A tool to Archive & delete mysql ( snortdb ) records .. Hugo Ferr (Jun 03)
• bpf filter Omolayo Salako (Jun 03)
  • RE: bpf filter Ashley Thomas (Jun 03)
• RE: Ignore multiple hosts with command line arguments McCammon, Keith (Jun 03)
  • <Possible follow-ups>
  • Ignore multiple hosts with command line arguments McKim, Tim (Jun 03)
    • Re: Ignore multiple hosts with command line arguments Chris Green (Jun 03)
• RE: Ignore multiple hosts with command line argumen ts Tom Sevy (Jun 03)
  • Re: Ignore multiple hosts with command line argumen ts Phil Wood (Jun 03)
• Preprocessors COULOMBE, TROY (Jun 03)
  • <Possible follow-ups>
  • Re: Preprocessors matt (Jun 03)
• mysql config error Omolayo Salako (Jun 03)
• Order of preprocessing... Ashley Thomas (Jun 03)
  • Re: [Snort-devel] Order of preprocessing... Chris Green (Jun 03)
• RE: Multiple IP (ethernet switches vs hubs) Semerjian, Ohanes (Jun 03)
• 1.8.6 problem: Misdetection and hangup Jesus Couto (Jun 04)
  • Re: 1.8.6 problem: Misdetection and hangup Chris Green (Jun 04)
• snort 1.9.x would not compile on FreeBSD 4.5 Henk Wevers (Jun 04)
  • Re: snort 1.9.x would not compile on FreeBSD 4.5 (snapshot build?) matt (Jun 04)
    • Re: snort 1.9.x would not compile on FreeBSD 4.5 (snapshot build?) Henk Wevers (Jun 04)
    • Re: snort 1.9.x would not compile on FreeBSD 4.5/4.6 (confirm) Peter Johnson (Jun 04)
  • Re: snort 1.9.x would not compile on FreeBSD 4.5 Chris Green (Jun 04)
    • Re: snort 1.9.x would not compile on FreeBSD 4.5 Henk Wevers (Jun 04)
    • Re: snort 1.9.x would not compile on FreeBSD 4.5 Peter Johnson (Jun 04)
  • <Possible follow-ups>
  • snort 1.9.x would not compile on FreeBSD 4.5 Henk Wevers (Jun 04)
• port 22 scan Gongya Yu (Jun 04)
  • <Possible follow-ups>
  • RE: port 22 scan Wirth, Jeff (Jun 04)
  • Re: port 22 scan Muhammad Faisal Rauf Danka (Jun 04)
• RE : port 22 scan Christophe Sahut (Jun 04)
• Snort Implementation Guide - ACID-MySQL-Redhat7.2 Steve Scott (Jun 04)
  • Re: Snort Implementation Guide - ACID-MySQL-Redhat7.2 Hugo Ferr (Jun 04)
    • Re: Snort Implementation Guide - ACID-MySQL-Redhat7.2 Steve Scott (Jun 05)
      • Re: Snort Implementation Guide - ACID-MySQL-Redhat7.2 Hugo Ferr (Jun 05)
  • <Possible follow-ups>
  • Re: Snort Implementation Guide - ACID-MySQL-Redhat7.2 Piotr Bulczak (Jun 04)
    • Re: Snort Implementation Guide - ACID-MySQL-Redhat7.2 Steve Scott (Jun 05)
• Snort Logs to MySQL, ACID Sees the Alerts, But Queries Don't Work Robinson, Eric R. (Jun 04)
• Best real-time alerting tool Sheahan, Paul (PCLN-NW) (Jun 04)
  • RE: Best real-time alerting tool Don (Jun 04)
  • <Possible follow-ups>
  • RE: Best real-time alerting tool Tom Sevy (Jun 05)
  • RE: Best real-time alerting tool Sheahan, Paul (PCLN-NW) (Jun 05)
  • Re: Best real-time alerting tool CJATeck (Jun 05)
  • RE: Best real-time alerting tool Ryan Hill (Jun 05)
    • icmp i want to ignore Don (Jun 05)
      • Re: icmp i want to ignore Steve Scott (Jun 05)
      • Re: icmp i want to ignore Erek Adams (Jun 05)
  • RE: Best real-time alerting tool Fraser Hugh (Jun 06)
  • RE: Best real-time alerting tool Fraser Hugh (Jun 07)
  • RE: Best real-time alerting tool John Ruff (Jun 09)
• Solaris checksum problem Hector Urdaneta (Jun 04)
• portscan-ignorehosts question Joseph Inserra (Jun 04)
  • Re: portscan-ignorehosts question Scot Scot (Jun 05)
    • Re: portscan-ignorehosts question Erek Adams (Jun 05)
• snort 1.8.7 and fragroute Peter . VE (Jun 05)
  • Re: snort 1.8.7 and fragroute Chris Green (Jun 05)
  • <Possible follow-ups>
  • Snort 1.8.7 and fragroute Peter V.E. (Jun 24)
  • RE: Snort 1.8.7 and fragroute Slighter, Tim (Jun 24)
• ATTN: Michael Scheidell Rob Hughes (Jun 05)
• NOVA snort user's group meeting Chris Green (Jun 05)
  • <Possible follow-ups>
  • RE: NOVA snort user's group meeting McCammon, Keith (Jun 05)
• Snort & Acid on OpenBSD 3.1? arlenf (Jun 05)
  • <Possible follow-ups>
  • Re: Snort & Acid on OpenBSD 3.1? Addam Schroll (Jun 06)
  • Re: Snort & Acid on OpenBSD 3.1? arlenf (Jun 06)
• LaBrea Hugo Ferr (Jun 05)
  • Re: LaBrea Frank Knobbe (Jun 05)
    • Re: LaBrea Hugo Ferr (Jun 06)
  • Re: LaBrea Fyodor (Jun 05)
    • Re: LaBrea Frank Knobbe (Jun 05)
    • Re: LaBrea Hugo Ferr (Jun 06)
      • Re: LaBrea Gianluca Marcari (Jun 06)
      • Re: LaBrea Hugo Ferr (Jun 07)
      • RE: LaBrea Paul Hem (Jun 07)
      • Re: LaBrea Hugo Ferr (Jun 09)
• Problem with ACID and Solution. Federico Rena (Jun 06)
  • <Possible follow-ups>
  • Re: Problem with ACID and Solution. Roman Danyliw (Jun 15)
• ACID enhancement Kristopher Czachor (Jun 06)
  • Re: ACID enhancement Michael Scheidell (Jun 07)
  • <Possible follow-ups>
  • RE: ACID enhancement Hicks, John (Jun 07)
• matching logs.. Ashley Thomas (Jun 06)
  • RE: matching logs.. Ashley Thomas (Jun 06)
  • Re: matching logs.. Erek Adams (Jun 06)
    • syslog Don (Jun 06)
      • Re: syslog Erek Adams (Jun 06)
      • RE: syslog Jeff Dell (Jun 06)
      • RE: syslog Don (Jun 06)
      • SQL login attempts Don (Jun 07)
• New Forums Jim Forster (Jun 06)
• Ignore Hosts How-To Erek Adams (Jun 07)
• Dr. Watson when Logging in Binary Mode Parker, Ian (Jun 07)
  • Re: [despammed] Dr. Watson when Logging in Binary Mode Ed McMan (Jun 11)
• Core dumping with more then 1 rule enabled Frank Lewandowski (Jun 07)
  • RE: Core dumping with more then 1 rule enabled - SUMMARY Frank Lewandowski (Jun 08)
  • Re: Core dumping with more then 1 rule enabled Chris Green (Jun 08)
    • Re: Core dumping with more then 1 rule enabled Chris Green (Jun 08)
  • Re: Core dumping with more then 1 rule enabled James Hoagland (Jun 08)
• Description of snort plugins Darrin Powell (Jun 07)
• Packet payload Ashley Thomas (Jun 08)
  • RE: Packet payload Wayne T Work (Jun 08)
  • Re: Packet payload Erek Adams (Jun 08)
• redworm sanity check John Hally (Jun 08)
  • FYI - Possible cause for false positive - ICMP L3retriever Ping Michael Gargiullo (Jun 12)
    • Re: FYI - Possible cause for false positive - ICMP L3retriever Ping Chris Green (Jun 13)
• flags James Ashton (Jun 08)
  • Re: flags Rob Hughes (Jun 08)
    • Re: flags James Ashton (Jun 08)
      • Re: flags Rob Hughes (Jun 09)
  • <Possible follow-ups>
  • RE: flags James Ashton (Jun 09)
    • RE: flags Erek Adams (Jun 09)
  • RE: flags Brenda A. Bell (Jun 11)
    • RE: flags Erek Adams (Jun 11)
• snort not logging steve nutt (Jun 08)
  • Re: snort not logging Rob Hughes (Jun 09)
    • Re: snort not logging steve nutt (Jun 09)
      • Re: snort not logging Rob Hughes (Jun 09)
  • <Possible follow-ups>
  • snort not logging steve nutt (Jun 08)
• portscan ? Ashley Thomas (Jun 08)
  • <Possible follow-ups>
  • RE: portscan ? Estes, Matt PEO EIS CPR / FCBS (Jun 10)
• Exclude Source? Darren Young (Jun 09)
  • Re: Exclude Source? John Sage (Jun 09)
• Practical Limits on Snort/MySQL? Michael J Worden (Jun 09)
• Questionnaire for FAQ on 'how many alerts does snort receive'. Imran William Smith (Jun 09)
• use of BPF in 1.8.7beta6 might be broken Michael Scheidell (Jun 09)
  • Re: use of BPF in 1.8.7beta6 might be broken Chris Green (Jun 11)
• barnyard James Ashton (Jun 09)
• [Snorting 2 NICs] Gregory D Hough (Jun 10)
  • Re: [Snorting 2 NICs] Petr Ruzicka (Jun 10)
  • <Possible follow-ups>
  • RE: [Snorting 2 NICs] McCammon, Keith (Jun 10)
    • RE: [Snorting 2 NICs] K.S.NARAYANAN (Jun 10)
      • Re: [Snorting 2 NICs] Gregory D Hough (Jun 11)
      • Re: [Snorting 2 NICs] Erek Adams (Jun 11)
      • RE: [Snorting 2 NICs] K.S.NARAYANAN (Jun 11)
      • Re: [Snorting 2 NICs] Martin Forest (Jun 13)
  • FW: [Snorting 2 NICs] McCammon, Keith (Jun 10)
  • RE: [Snorting 2 NICs] COULOMBE, TROY (Jun 11)
• Compilation Error Alwin Raymundo (Jun 10)
  • Re: Compilation Error Chris Green (Jun 10)
    • Re: Compilation Error Alwin Raymundo (Jun 11)
• AW: [Snorting 2 NICs] Poppi, Sandro (Jun 10)
  • <Possible follow-ups>
  • AW: [Snorting 2 NICs] Poppi, Sandro (Jun 11)
• Demarc Plugins Darren Young (Jun 10)
• Compile problems on solaris 2.6 Walgamotte, David (Jun 10)
  • Re: Compile problems on solaris 2.6 Erek Adams (Jun 10)
  • Re: Compile problems on solaris 2.6 Ryan Russell (Jun 10)
• solaris 8 compile Roger (Jun 10)
• Auditing Snort Rules (Signatures) D W (Jun 10)
• Session data, alerts, and barnyard Ed Quackenbush (Jun 10)
  • Re: Session data, alerts, and barnyard Martin Roesch (Jun 11)
  • <Possible follow-ups>
  • RE: Session data, alerts, and barnyard Ed Quackenbush (Jun 11)
• Setting the nic up ?? Walgamotte, David (Jun 10)
  • Re: Setting the nic up ?? D W (Jun 10)
  • Re: Setting the nic up ?? Glenn Forbes Fleming Larratt (Jun 10)
  • <Possible follow-ups>
  • RE: Setting the nic up ?? COULOMBE, TROY (Jun 10)
  • RE: Setting the nic up ?? Walgamotte, David (Jun 10)
    • RE: Setting the nic up ?? Erek Adams (Jun 10)
• Current Rule Set Hall, Duane (Jun 10)
  • Re: Current Rule Set D W (Jun 10)
  • Re: Current Rule Set Erek Adams (Jun 10)
  • Re: Current Rule Set Matt Kettler (Jun 10)
  • Re: Current Rule Set Elinus Liga (Jun 12)
  • <Possible follow-ups>
  • RE: Current Rule Set McCammon, Keith (Jun 10)
• Re: FW: heya - Glenn Mansfield Keeni (Jun 10)
• Mandrake setup Ben Whittaker (Jun 11)
• spp_portscan msg DICEJ (Jun 11)
  • Re: spp_portscan msg Erek Adams (Jun 11)
• acid alert group Maarten (Jun 11)
• PostgreSQL Indexes Gfm (Jun 11)
  • <Possible follow-ups>
  • RE: PostgreSQL Indexes Hutchinson, Andrew (Jun 12)
  • RE: PostgreSQL Indexes Hutchinson, Andrew (Jun 13)
• I need some serious help Don (Jun 11)
  • Re: I need some serious help Erek Adams (Jun 11)
    • RE: I need some serious help Don (Jun 11)
      • RE: I need some serious help Erek Adams (Jun 11)
• Snort and MRTG Shane Hickey (Jun 11)
• Logging payload to syslog jromariz (Jun 11)
• use of tables DoL (Jun 11)
  • <Possible follow-ups>
  • Re: use of tables roman (Jun 12)
  • Re: use of tables DoL (Jun 12)
• Syslog on W2K Steven Williams (Jun 11)
  • RE: Syslog on W2K Don (Jun 12)
  • RE: Syslog on W2K Michael Steele (Jun 12)
  • <Possible follow-ups>
  • RE: Syslog on W2K Steven Williams (Jun 12)
    • RE: Syslog on W2K Blake Fithen (Jun 12)
      • Re: Syslog on W2K Scot Scot (Jun 12)
      • RE: Syslog on W2K Don (Jun 13)
• Patch for Time criteria handling in ACID Mark Vevers (Jun 12)
  • <Possible follow-ups>
  • Patch for Time criteria handling in ACID Mark Vevers (Jun 13)
  • Re: Patch for Time criteria handling in ACID Roman Danyliw (Jun 15)
• Detecting concurrent connections Renato Ara�jo (Jun 12)
  • Re: Detecting concurrent connections Chris Green (Jun 12)
  • Re: Detecting concurrent connections matt (Jun 12)
• linker cannot find mysqlclient Tilo Schneider <T.Schneider () tfh-berlin de> (Jun 12)
• snort with mysql and acid C White (Jun 12)
  • <Possible follow-ups>
  • Re: snort with mysql and acid roman (Jun 12)
  • RE: snort with mysql and acid Damien Hart (Jun 13)
• Configuration HELP! Jason Martin (Jun 12)
  • Re: Configuration HELP! (understanding alerts and proxies) matt (Jun 12)
• Dies Bravard, Paul (Jun 12)
  • <Possible follow-ups>
  • Re: Dies roman (Jun 13)
• : Configuration HELP! (understanding alerts and pro xies) Jason Martin (Jun 12)
  • Re: : Configuration HELP! (understanding alerts and proxies) Matt Kettler (Jun 12)
    • Re: : Configuration HELP! (understanding alerts and proxies) Scot Scot (Jun 12)
• RE: Snort-users digest, Vol 1 #1962 - 13 msgs Jessup, Justin (Jun 12)
• Snort and 802.1Q larosa, vjay (Jun 12)
  • Snort front ends jas (Jun 12)
  • Snort front ends Jerry Shenk (Jun 13)
    • Re: Snort front ends Shawn Duffy (Jun 13)
      • Re: Snort front ends Stefan Dens (Jun 14)
• acidlab: restoring snort_archive to snort_log Dmitry Glushenok (Jun 12)
• RE: Snort front ends jas (Jun 13)
  • <Possible follow-ups>
  • RE: Snort front ends jas (Jun 13)
  • RE: Snort front ends Jerry Shenk (Jun 13)
  • RE: Snort front ends Jerry Shenk (Jun 13)
• IDS126/X11_OUTGOING_XTERM ? Hilton De Meillon (Jun 13)
  • RE: IDS126/X11_OUTGOING_XTERM ? Jordi Vila (Jun 13)
• newbie - excluding an IP Address Anthony Scott (Jun 13)
  • <Possible follow-ups>
  • RE: newbie - excluding an IP Address McCammon, Keith (Jun 13)
• Empty alert records in unified spool for portscan and bo preproce ssors... Ed Quackenbush (Jun 13)
• select rules DoL (Jun 13)
  • <Possible follow-ups>
  • RE: select rules McCammon, Keith (Jun 13)
    • Re: select rules DoL (Jun 13)
  • SELECT RULES John Maestrale (Jun 13)
• OT: IP Blocks by country/region? Tom Sevy (Jun 13)
  • Re: OT: IP Blocks by country/region? Imran William Smith (Jun 13)
  • <Possible follow-ups>
  • RE: OT: IP Blocks by country/region? Hicks, John (Jun 13)
  • RE: OT: IP Blocks by country/region? McCammon, Keith (Jun 13)
  • RE: OT: IP Blocks by country/region? Tom Sevy (Jun 13)
  • RE: OT: IP Blocks by country/region? Tony Carothers (Jun 13)
• My Webservers Are Showing Up In My Alerts Vadim Pushkin (Jun 13)
  • Re: My Webservers Are Showing Up In My Alerts Matt Kettler (Jun 13)
  • <Possible follow-ups>
  • Re: My Webservers Are Showing Up In My Alerts Vadim Pushkin (Jun 13)
    • Re: My Webservers Are Showing Up In My Alerts matt (Jun 13)
  • Re: My Webservers Are Showing Up In My Alerts Vadim Pushkin (Jun 13)
    • Re: My Webservers Are Showing Up In My Alerts matt (Jun 13)
  • Re: My Webservers Are Showing Up In My Alerts Muhammad Faisal Rauf Danka (Jun 13)
  • Re: My Webservers Are Showing Up In My Alerts Vadim Pushkin (Jun 14)
  • Re: My Webservers Are Showing Up In My Alerts Vadim Pushkin (Jun 14)
• [ANN] HenWen 1.0 for Snort Nick Zitzmann (Jun 13)
• Exploit? Michael Northup (Jun 13)
  • Re: Exploit? (RCPT overflow) matt (Jun 13)
  • Curse of the cmd.exe Sam Evans (Jun 13)
    • Re: Curse of the cmd.exe Chris Keladis (Jun 14)
    • RE: Curse of the cmd.exe Andy McLeod (Jun 17)
  • RE: Exploit? Don (Jun 13)
  • <Possible follow-ups>
  • RE: Exploit? Hilton De Meillon (Jun 13)
  • RE: Exploit? Michael Brown (Jun 17)
• OT: Common services signatures Patrick McHardy (Jun 13)
• Count option WAS smtp rcpt to overflow Greg Wright (Jun 13)
  • RE: Count option WAS smtp rcpt to overflow Andy McLeod (Jun 17)
• packet drops Unteregger Ruben (Jun 13)
• error initializing the network interface on win2k cwhite (Jun 13)
  • RE: error initializing the network interface on win2k Don (Jun 13)
• RE: error initializing the network interface on win 2k Hicks, John (Jun 13)
• RE: Curse of the cmd.exe Matt Yackley (Jun 14)
  • <Possible follow-ups>
  • RE: Curse of the cmd.exe Andreas Östling (Jun 15)
  • RE: Curse of the cmd.exe MOLLOY, Brendan, GCM (Jun 17)
  • RE: Curse of the cmd.exe M. Burnett (Jun 17)
• Changing the filename format for alerts McKim, Tim (Jun 14)
  • Re: Changing the filename format for alerts Frank Knobbe (Jun 14)
• Applolgy for the HTML email- Snort Filename format McKim, Tim (Jun 14)
• OT E-mail Viruses Madziarczyk, Jonathan (Jun 14)
  • Re: SMTP Virus Gateway Joshua James (Jun 14)
    • Re: SMTP Virus Gateway Joe Matusiewicz (Jun 14)
    • Re: SMTP Virus Gateway Ralf Hildebrandt (Jun 14)
• RE: SMTP Virus Gateway McCammon, Keith (Jun 14)
  • RE: SMTP Virus Gateway K.S.NARAYANAN (Jun 16)
  • <Possible follow-ups>
  • RE: SMTP Virus Gateway matt (Jun 14)
• How can I Verify That I am performing UDP de-fragging? Vadim Pushkin (Jun 14)
• RE: Running 2 instances of snort Michael Steele (Jun 14)
  • <Possible follow-ups>
  • RE: Running 2 instances of snort Michael Steele (Jun 15)
• RE: Snort on Acid instructions Michael Steele (Jun 14)
  • <Possible follow-ups>
  • RE: RE: Snort on Acid instructions Michael Steele (Jun 15)
• Testing tools DoL (Jun 15)
  • Re: Testing tools Scot Scot (Jun 16)
  • Re: Testing tools Andrea Barisani (Jun 16)
  • Re: Testing tools Marnix Petrarca (Jun 16)
  • <Possible follow-ups>
  • Re: Testing tools Marnix Petrarca (Jun 16)
• snort CVS checkout fails to build Ralf Hildebrandt (Jun 16)
• rule for Yahoo or Hotmail messengers Ronneil Camara (Jun 16)
  • Re: rule for Yahoo or Hotmail messengers Imran William Smith (Jun 17)
• Re: Snort-users #1972 OT Email/AV Ranting Joe Pampel (Jun 17)
• EXPLOIT ssh CRC32 false alerts Jean Michel BARBET (Jun 17)
• Outgoing FTP Rule? Brad Merluzzi (Jun 17)
• Problem emailing alerts from ACID Bradley, Paul (Jun 17)
  • <Possible follow-ups>
  • RE: Problem emailing alerts from ACID Ronneil Camara (Jun 17)
    • RE: Problem emailing alerts from ACID Michael Steele (Jun 17)
  • RE: Problem emailing alerts from ACID Bradley, Paul (Jun 17)
  • RE: Problem emailing alerts from ACID Ronneil Camara (Jun 17)
  • RE: Problem emailing alerts from ACID Robin Brown (Jun 18)
  • RE: Problem emailing alerts from ACID Bradley, Paul (Jun 18)
• what's the best setup? c white (Jun 17)
  • <Possible follow-ups>
  • RE: what's the best setup? Chris Eidem (Jun 17)
• Message: 5 - What's the best setup Joe Pampel (Jun 17)
• Tying alerts to hostnames? Scott Phippen (Jun 17)
  • Re: Tying alerts to hostnames? Chris Green (Jun 17)
  • Re: Tying alerts to hostnames? Erek Adams (Jun 17)
  • Re: Tying alerts to hostnames? John Sage (Jun 17)
    • Re: Tying alerts to hostnames? - Windowz Tools Scot Scot (Jun 18)
  • <Possible follow-ups>
  • RE: Tying alerts to hostnames? Hicks, John (Jun 18)
• Installing Snort on Win 2K Raoul Armfield (Jun 17)
  • RE: Installing Snort on Win 2K Rodney Wise (Jun 17)
    • Re: Installing Snort on Win 2K Byron (Jun 17)
    • RE: Installing Snort on Win 2K Michael Steele (Jun 17)
  • RE: Installing Snort on Win 2K Michael Steele (Jun 17)
    • RE: Installing Snort on Win 2K Rodney Wise (Jun 18)
      • RE: Installing Snort on Win 2K Raoul Armfield (Jun 18)
• WinPcap 2.3 and Win2k Madziarczyk, Jonathan (Jun 17)
  • RE: WinPcap 2.3 and Win2k Michael Steele (Jun 17)
    • unsubscribe Andreas Krassek (Jun 18)
  • <Possible follow-ups>
  • RE: WinPcap 2.3 and Win2k Madziarczyk, Jonathan (Jun 18)
  • RE: WinPcap 2.3 and Win2k Hicks, John (Jun 18)
    • Re: WinPcap 2.3 and Win2k Marnix Petrarca (Jun 18)
  • RE: WinPcap 2.3 and Win2k Hicks, John (Jun 18)
  • RE: WinPcap 2.3 and Win2k Madziarczyk, Jonathan (Jun 18)
• PureSecure is crazy François Jan (Jun 17)
  • Re: PureSecure is crazy Ian Macdonald (Jun 18)
    • Re: PureSecure is crazy François Jan (Jun 18)
  • <Possible follow-ups>
  • RE: PureSecure is crazy Robin Brown (Jun 18)
• snort occupy all cpu time? Vincent Chen (Jun 17)
  • Re: snort occupy all cpu time? Ian Macdonald (Jun 18)
• DoS Alert in Snort Pathmenanthan Ramakrishna (Jun 17)
• Tom Lyne is out of the office. Tom Lyne (Jun 18)
• newbie pass rule question Eric Garnel (Jun 18)
  • Re: newbie pass rule question Erek Adams (Jun 18)
• problema with snort for linux Salvatore Basso (Jun 18)
  • <Possible follow-ups>
  • RE: problema with snort for linux Slighter, Tim (Jun 18)
• IDS and traffic monitor in one Milan Kubala (Jun 18)
  • Re: IDS and traffic monitor in one Erek Adams (Jun 18)
• More WinPcap 2.3 and Win2k Madziarczyk, Jonathan (Jun 18)
  • Re: More WinPcap 2.3 and Win2k Chris Reid (Jun 18)
    • RE: More WinPcap 2.3 and Win2k Michael Steele (Jun 18)
      • RE: More WinPcap 2.3 and Win2k Don (Jun 19)
      • RE: More WinPcap 2.3 and Win2k Don (Jun 19)
• BO pre-processor larosa, vjay (Jun 18)
  • Re: BO pre-processor Beno Chapman (Jun 18)
  • <Possible follow-ups>
  • RE: BO pre-processor larosa, vjay (Jun 18)
    • Re: RE: BO pre-processor Larc (Jun 18)
  • RE: RE: BO pre-processor larosa, vjay (Jun 18)
  • RE: RE: BO pre-processor Claude Bailey (Jun 18)
• Snort send mail on alert Salvatore Basso (Jun 18)
  • Re: Snort send mail on alert Erek Adams (Jun 18)
• Resp/React Firing Problem/Bug MASM (Jun 18)
• Snort and ACID on separate systems? Djinn D'Angel (Jun 18)
  • Re: Snort and ACID on separate systems? Greg Robinson (Jun 18)
  • Re: Snort and ACID on separate systems? Erek Adams (Jun 18)
• built with mysql, but snort says I didn't tbasilio (Jun 18)
• OT queries on acid in confusion... Jon Quiros (Jun 18)
  • Re: OT queries on acid in confusion... John Sage (Jun 19)
  • <Possible follow-ups>
  • Re: OT queries on acid in confusion... roman (Jun 19)
    • Re: OT queries on acid in confusion... Jon Quiros (Jun 19)
  • Re: OT queries on acid in confusion... Jon Quiros (Jun 19)
  • Re: OT queries on acid in confusion... roman (Jun 20)
• Snort at boot Zutroi Zatatakowski (Jun 18)
  • Re: Snort at boot Andreas Östling (Jun 18)
  • RE: Snort at boot Robert Schwartz (Jun 18)
  • <Possible follow-ups>
  • RE: Snort at boot McCammon, Keith (Jun 18)
• Help with where to place a Snort sensor! -newbie questions- Daniel Lopez (Jun 19)
• AW: Help with where to place a Snort sensor! -newbi e questions- Poppi, Sandro (Jun 19)
  • Snort performance (was Re: Help with where to place ...) Bennett Todd (Jun 24)
    • RE: Snort performance (was Re: Help with where to place ...) Ashley Thomas (Jun 24)
• Where are portscans stored ? Hilton De Meillon (Jun 19)
  • Re: Where are portscans stored ? Kevin Riggins (Jun 20)
• snort 1.8.6 and AIX 4.3.3 gilles . lami (Jun 19)
  • Re: snort 1.8.6 and AIX 4.3.3 Chris Green (Jun 19)
  • <Possible follow-ups>
  • snort 1.8.6 and AIX 4.3.3 gilles . lami (Jun 22)
    • Re: snort 1.8.6 and AIX 4.3.3 Martin Roesch (Jun 23)
• Problems logging to syslog and mysql simultaneously dlpassport (Jun 19)
  • RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 19)
  • <Possible follow-ups>
  • RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 19)
  • RE: Problems logging to syslog and mysql simultaneously dlpassport (Jun 19)
    • RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 19)
  • RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 19)
    • RE: Problems logging to syslog and mysql simultaneously Don (Jun 19)
      • RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 19)
      • RE: Problems logging to syslog and mysql simultaneously Frank Knobbe (Jun 21)
      • RE: Problems logging to syslog and mysqlsimultaneously Michael Steele (Jun 21)
      • RE: Problems logging to syslog and mysqlsimultaneously Don (Jun 22)
  • RE: Problems logging to syslog and mysql simultaneously Steven Williams (Jun 19)
  • RE: Problems logging to syslog and mysql simultaneously dlpassport (Jun 20)
  • RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 20)
• Hotmail John Maestrale (Jun 19)
  • <Possible follow-ups>
  • RE: Hotmail Kreimendahl, Chad J (Jun 19)
• FW: ERROR: OpenPcap Michael Steele (Jun 19)
  • Re: FW: ERROR: OpenPcap Chris Reid (Jun 19)
  • <Possible follow-ups>
  • FW: FW: ERROR: OpenPcap Michael Steele (Jun 19)
  • FW: FW: ERROR: OpenPcap Michael Steele (Jun 19)
• spp_portscan to ignore a port? Kevin L Pawloski (Jun 19)
• New Install Infinity (Jun 19)
  • RE: New Install Michael Steele (Jun 19)
    • RE: New Install Infinity (Jun 19)
      • RE: New Install Michael Steele (Jun 19)
      • RE: New Install Infinity (Jun 19)
• Acid MySQL problem Larry Taylor (Jun 20)
• alert file problem Ganu Skop (Jun 20)
• Réf. : Re: [Snort-users] snort 1.8.6 and AIX 4.3.3 LAMI, Gilles - DSIA (Jun 20)
• [spp_portscan] Gregory D Hough (Jun 20)
  • Re: [spp_portscan] Matt Kettler (Jun 20)
    • Snort and SysLogging, warning Don (Jun 20)
      • Re: Snort and SysLogging, warning Imran William Smith (Jun 20)
• Snort Questions Sandy Martin (Jun 20)
  • Re: Snort Questions Mike Shaw (Jun 20)
  • RE: Snort Questions Michael Steele (Jun 20)
• Snort & multi-port ethernet cards Tom Sevy (Jun 20)
  • Re: Snort & multi-port ethernet cards Erek Adams (Jun 20)
  • <Possible follow-ups>
  • RE: Snort & multi-port ethernet cards McCammon, Keith (Jun 20)
  • RE: Snort & multi-port ethernet cards larosa, vjay (Jun 20)
• AW: Snort & multi-port ethernet cards Poppi, Sandro (Jun 20)
• RE: Problems logging to syslog and mysql simultaneo usly LaRose, Dallas (Jun 20)
  • <Possible follow-ups>
  • RE: Problems logging to syslog and mysql simultaneo usly Robbins, Mark (Jun 20)
  • RE: Problems logging to syslog and mysql simultaneo usly LaRose, Dallas (Jun 26)
    • RE: Problems logging to syslog and mysql simultaneously Don (Jun 26)
• multiple HTTP_PORTS Chris Connelly (Jun 20)
  • Re: multiple HTTP_PORTS Erek Adams (Jun 20)
• HELP Port 1080 only DThomaz (Jun 20)
• Snort 1.8.6 and PPPoE links C.J.O. (Jun 20)
• portscan.log empty despite nmap scan? systemic (Jun 20)
  • <Possible follow-ups>
  • RE: portscan.log empty despite nmap scan? Slighter, Tim (Jun 21)
• Snort ---> syslog spy (Jun 20)
  • RE: Snort ---> syslog Michael Steele (Jun 21)
    • RE: Snort ---> syslog Don (Jun 21)
      • RE: Snort ---> syslog Michael Steele (Jun 21)
• Snort & multi-port ethernet cards -- PART II Tom Sevy (Jun 21)
• Snort rules touble. Jason Gauthier (Jun 21)
  • Re: Snort rules touble. Ryan Russell (Jun 21)
  • Re: Snort rules touble. Matt Kettler (Jun 21)
  • <Possible follow-ups>
  • RE: Snort rules touble. Slighter, Tim (Jun 21)
  • RE: Snort rules touble. Jason Gauthier (Jun 21)
    • RE: Snort rules touble. Erek Adams (Jun 21)
  • RE: Snort rules touble. Jason Gauthier (Jun 21)
    • RE: Snort rules touble. Matt Kettler (Jun 21)
  • RE: Snort rules touble. Slighter, Tim (Jun 21)
  • RE: Snort rules touble. Slighter, Tim (Jun 21)
    • RE: Snort rules touble. Erek Adams (Jun 21)
      • RE: Snort rules touble. Andreas Östling (Jun 21)
      • RE: Snort rules touble. Erek Adams (Jun 21)
  • RE: Snort rules touble. Slighter, Tim (Jun 21)
    • RE: Snort rules touble. Erek Adams (Jun 21)
  • RE: Snort rules touble. Jason Gauthier (Jun 21)
• Snort IDScenter 1.09 beta 2 is out Kistler Ueli (Jun 21)
• RE: Snort Michael Steele (Jun 21)
  • <Possible follow-ups>
  • RE: RE: Snort Michael Steele (Jun 21)
• Real Time Alert sensor Pathmenanthan Ramakrishna (Jun 21)
  • Re: Real Time Alert sensor Martin Roesch (Jun 23)
• AW: Snort & multi-port ethernet cards -- PART II Poppi, Sandro (Jun 22)
• Mysql problem Steve Moran (Jun 22)
  • Re: Mysql problem Alex Pinheiro Machado Rodrigues (Jun 22)
  • Re: Mysql problem Imran William Smith (Jun 23)
  • Re: Mysql problem Michael Gargiullo (Jun 23)
  • <Possible follow-ups>
  • Re: Re: Mysql problem roman (Jun 22)
• IDScenter 1.09 beta 2 released -- New features like Snort configuration wizard, MySQL alert detection, etc.. Kistler Ueli (Jun 22)
• OpenBSD, snort, Two nic's outside network Jonathan (Jun 22)
  • RE: OpenBSD, snort, Two nic's outside network Robert Schwartz (Jun 24)
• EXTERNAL_NET Ashley Thomas (Jun 22)
  • Re: EXTERNAL_NET Phil Wood (Jun 22)
    • RE: EXTERNAL_NET Don (Jun 23)
    • RE: EXTERNAL_NET Ashley Thomas (Jun 23)
      • Re: EXTERNAL_NET Phil Wood (Jun 23)
• ACID url Links on IIS Ross Draper (Jun 23)
• Rules problem on dual nic vpn server... Bryce Stenberg (Jun 23)
• AW: Rules problem on dual nic vpn server... Poppi, Sandro (Jun 23)
• RE: A couple more questions Michael Steele (Jun 24)
• Snort Interfaces problem (Win32) Paul J. Smith (Jun 24)
  • RE: Snort Interfaces problem (Win32) Michael Steele (Jun 24)
  • Re: Snort Interfaces problem (Win32) John Sage (Jun 24)
    • RE: Snort Interfaces problem (Win32) Michael Steele (Jun 24)
  • <Possible follow-ups>
  • RE: Snort Interfaces problem (Win32) Michael Steele (Jun 24)
• snort and puresecure problem Omolayo Salako (Jun 24)
  • <Possible follow-ups>
  • snort and puresecure problem Robin Brown (Jun 26)
  • RE: snort and puresecure problem Omolayo Salako (Jun 26)
• Snort Topology Configuration DThomaz (Jun 24)
  • <Possible follow-ups>
  • Re: Snort Topology Configuration Jon Quiros (Jun 24)
  • RE: Snort Topology Configuration McCammon, Keith (Jun 24)
  • Re: Snort Topology Configuration Jon Quiros (Jun 24)
  • RE: Snort Topology Configuration Hutchinson, Andrew (Jun 24)
• undefined reference to `dlopen' Daniel Curry (Jun 24)
  • <Possible follow-ups>
  • Re: undefined reference to `dlopen' Roman Danyliw (Jun 25)
• *NIX ping alerts Jason Gauthier (Jun 24)
  • <Possible follow-ups>
  • RE: *NIX ping alerts McCammon, Keith (Jun 24)
  • RE: *NIX ping alerts Jason Gauthier (Jun 24)
  • RE: *NIX ping alerts McCammon, Keith (Jun 24)
  • RE: *NIX ping alerts Jason Gauthier (Jun 24)
• Snort not loggin max valdez (Jun 24)
  • Re: Snort not loggin Chris Green (Jun 24)
• ASCII logging Bill McCarty (Jun 24)
• Snort not loggin hack attempts Paul J. Smith (Jun 25)
  • Re: Snort not loggin hack attempts Roberto Suarez Soto (Jun 25)
    • Re: Snort not loggin hack attempts DataShark (Jun 25)
  • <Possible follow-ups>
  • Snort not loggin hack attempts Santoro, David (Jun 25)
• Stupid question, as in I ought to know the answer to this. Phil Wood (Jun 25)
  • Re: Stupid question, as in I ought to know the answer to Phil Wood (Jun 25)
• Should I worry?? Anthony Scott (Jun 25)
  • Re: Should I worry?? Chris Adams (Jun 25)
• Snort getting overloaded by http traffic: Ashley Thomas (Jun 25)
  • <Possible follow-ups>
  • RE: Snort getting overloaded by http traffic: McCammon, Keith (Jun 25)
    • Re: Snort getting overloaded by http traffic: hackerwacker (Jun 25)
    • Re: Snort getting overloaded by http traffic: Jason Haar (Jun 25)
      • Re: Snort getting overloaded by http traffic: Imran William Smith (Jun 25)
      • RE: Snort getting overloaded by http traffic: Ashley Thomas (Jun 25)
  • RE: Snort getting overloaded by http traffic: Matt Kettler (Jun 25)
  • RE: Snort getting overloaded by http traffic: larosa, vjay (Jun 26)
• False positives with SMTP RCPT TO overflow rule Nels Lindquist (Jun 25)
  • Re: False positives with SMTP RCPT TO overflow rule Matt Kettler (Jun 25)
    • Re: False positives with SMTP RCPT TO overflow rule Nels Lindquist (Jun 27)
      • Re: False positives with SMTP RCPT TO overflow rule Matt Kettler (Jun 27)
      • Re: False positives with SMTP RCPT TO overflow rule Chris Green (Jun 27)
  • <Possible follow-ups>
  • RE: False positives with SMTP RCPT TO overflow rule Slighter, Tim (Jun 25)
    • RE: False positives with SMTP RCPT TO overflow rule Nels Lindquist (Jun 25)
  • RE: False positives with SMTP RCPT TO overflow rule Slighter, Tim (Jun 26)
• snort-mysql installation - not logging Cearns Angela (Jun 25)
  • <Possible follow-ups>
  • Re: snort-mysql installation - not logging Roman Danyliw (Jun 26)
    • not detecting common intrusion Cearns Angela (Jun 26)
      • Re: not detecting common intrusion Erek Adams (Jun 26)
      • Re: not detecting common intrusion Cearns Angela (Jun 26)
      • Re: not detecting common intrusion Erek Adams (Jun 26)
      • Re: not detecting common intrusion Cearns Angela (Jun 26)
      • Re: not detecting common intrusion Erek Adams (Jun 27)
      • Re: not detecting common intrusion Jeff Nathan (Jun 27)
• port lists for 1.8 Ryan Hill (Jun 25)
  • Re: port lists for 1.8 Jeffrey Taylor (Jun 26)
  • Re: port lists for 1.8 Chris Green (Jun 26)
  • Re: port lists for 1.8 Jeffrey Taylor (Jun 27)
    • RE: port lists for 1.8 Kristopher Czachor (Jun 27)
      • Re: port lists for 1.8 Andrew R. Baker (Jun 27)
• newbie snort user on windows xp needs help please Scott Weeks (Jun 25)
  • <Possible follow-ups>
  • RE: newbie snort user on windows xp needs help please Michael Steele (Jun 26)
    • RE: newbie snort user on windows xp needs help please Scott Weeks (Jun 27)
  • RE: newbie snort user on windows xp needs help please Michael Steele (Jun 26)
  • RE: newbie snort user on windows xp needs help please Scott Weeks (Jun 28)
• HTTP-Proxy scan attempts Dave Packham (Jun 25)
• Preventing Attacks David Alexandre M. de Carvalho (Jun 25)
  • <Possible follow-ups>
  • RE: Preventing Attacks McCammon, Keith (Jun 26)
    • Re: Preventing Attacks Jeffrey Taylor (Jun 26)
      • Re: Preventing Attacks Jeff Taylor (Jun 27)
      • Re: Preventing Attacks John Sage (Jun 28)
    • Re: Preventing Attacks Jeffrey Taylor (Jun 27)
  • RE: Preventing Attacks Hicks, John (Jun 26)
  • RE: Preventing Attacks Slighter, Tim (Jun 26)
• EXTERNAL_NET = any - HOME_NET Serge Leschinsky (Jun 26)
  • RE: EXTERNAL_NET = any - HOME_NET Ashley Thomas (Jun 26)
    • Re[2]: EXTERNAL_NET = any - HOME_NET Serge Leschinsky (Jun 26)
    • Re[2]: EXTERNAL_NET = any - HOME_NET Serge Leschinsky (Jun 26)
  • <Possible follow-ups>
  • RE: EXTERNAL_NET = any - HOME_NET Tom Sevy (Jun 26)
• 3 Snort, 1 MySQL Jason Gauthier (Jun 26)
  • Re: 3 Snort, 1 MySQL Beno Chapman (Jun 28)
  • <Possible follow-ups>
  • RE: 3 Snort, 1 MySQL Jason Gauthier (Jun 28)
• Snort / SnortSnarf question about packet capture filenames Matt Yackley (Jun 26)
• RE: Snort / SnortSnarf question about packet captur e filenames Slighter, Tim (Jun 26)
  • <Possible follow-ups>
  • RE: Snort / SnortSnarf question about packet captur e filenames Matt Yackley (Jun 26)
• RE: Problems logging to syslog and mysql simultaneo usly LaRose, Dallas (Jun 26)
• [ANN] HenWen 1.0.2 for Snort Nick Zitzmann (Jun 26)
• I think I know the answer to this, but not 100% sure Eric Garnel (Jun 26)
  • <Possible follow-ups>
  • RE: I think I know the answer to this, but not 100% sure McCammon, Keith (Jun 26)
  • Re: I think I know the answer to this, but not 100% sure Mike_Sands (Jun 26)
  • Re: I think I know the answer to this, but not 100% sure Scot Scot (Jun 26)
• RE: Snort / SnortSnarf question about packet captur e filenames Slighter, Tim (Jun 26)
  • <Possible follow-ups>
  • RE: Snort / SnortSnarf question about packet captur e filenames Matt Yackley (Jun 26)
    • Re: Snort / SnortSnarf question about packet capture filenames K. A. Steensma (Jun 26)
  • RE: Snort / SnortSnarf question about packet captur e filenames Slighter, Tim (Jun 26)
• Issue with List/Sourceforge Jason Gauthier (Jun 26)
  • <Possible follow-ups>
  • RE: Issue with List/Sourceforge Hicks, John (Jun 26)
• Stoopid port syntax question Kristopher Czachor (Jun 26)
  • Re: Stoopid port syntax question Erek Adams (Jun 26)
    • Re: Stoopid port syntax question Bennett Todd (Jun 27)
      • Re: Stoopid port syntax question Chris Green (Jun 27)
      • RE: Stoopid port syntax question Kristopher Czachor (Jun 27)
      • Re: Stoopid port syntax question Chris Green (Jun 27)
• Why only detecting host-based attacks? Terry J Dunlap Jr (Jun 26)
  • RE: Why only detecting host-based attacks? David Chait (Jun 26)
• FreeBSD, Apache, and ACID Cloppert, Michael (Jun 26)
• List of IP Address DThomaz (Jun 26)
  • Re: List of IP Address Erek Adams (Jun 26)
  • <Possible follow-ups>
  • RE: List of IP Address McCammon, Keith (Jun 26)
• RE: Snort / SnortSnarf question about packet captur e filenames - FIXED Matt Yackley (Jun 26)
• Network World IDS report Jason Haar (Jun 26)
• Lost in the config file K. A. Steensma (Jun 26)
  • Re: Lost in the config file John Sage (Jun 26)
    • Re: Lost in the config file K. A. Steensma (Jun 26)
  • Re: Lost in the config file Erek Adams (Jun 27)
    • Re: Lost in the config file Erek Adams (Jun 27)
    • Re: Lost in the config file K. A. Steensma (Jun 27)
      • Re: Lost in the config file John Sage (Jun 27)
      • Re: Lost in the config file Michael Boman (Jun 27)
• ACID - Alert Group email problem Frank (Jun 26)
• Lost in the config file and searchable archives Ross Draper (Jun 27)
• Rman - 0.0.4 Alpha is out Mark Vevers (Jun 27)
• How to create the DB indices with postgresql Daniel Lang (Jun 27)
  • <Possible follow-ups>
  • RE: How to create the DB indices with postgresql Hutchinson, Andrew (Jun 27)
    • Re: How to create the DB indices with postgresql Daniel Lang (Jun 27)
  • RE: How to create the DB indices with postgresql Hutchinson, Andrew (Jun 27)
    • Re: How to create the DB indices with postgresql Ben (Jun 27)
      • Re: How to create the DB indices with postgresql Daniel Lang (Jun 28)
• RE: not detecting common intrusion Steve Halligan (Jun 27)
  • RE: not detecting common intrusion Cearns Angela (Jun 27)
  • RE: not detecting common intrusion Cearns Angela (Jun 27)
• re: 1. Network World IDS report (Jason Haar) Joe Pampel (Jun 27)
  • <Possible follow-ups>
  • RE: re: 1. Network World IDS report (Jason Haar) Hicks, John (Jun 27)
  • RE: re: 1. Network World IDS report (Jason Haar) Detmar Liesen (Jun 27)
• Barnyard 0.1.0 RC1 available Andrew R. Baker (Jun 27)
• SNORT GUI Carles Xavier Munyoz Baldó (Jun 27)
  • Re: SNORT GUI Larc (Jun 27)
  • <Possible follow-ups>
  • Re: SNORT GUI Kistler Ueli (Jun 27)
  • Re: SNORT GUI Kevin L Pawloski (Jun 27)
• verification test? Daniel Curry (Jun 27)
• RE: Setting up Snort on Windows Michael Steele (Jun 27)
• snort and slackware.. radus (Jun 27)
  • Re: snort and slackware..(logging question) Matt Kettler (Jun 27)
• Setting up a Windowz Interface to monitor with no IP Address Scot Scot (Jun 27)
  • RE: Setting up a Windowz Interface to monitor with no IP Address Michael Steele (Jun 27)
  • <Possible follow-ups>
  • RE: Setting up a Windowz Interface to monitor with no IP Address Detmar Liesen (Jun 28)
    • RE: Setting up a Windowz Interface to monitor with no IP Address Michael Steele (Jun 28)
  • RE: Setting up a Windowz Interface to monitor with no IP Address McCammon, Keith (Jun 28)
  • Re: Setting up a Windowz Interface to monitor with no IP Address Scot Scot (Jun 28)
• [Slightly OT]: what syslog daemon actually ignores the client timestamp? Jason Haar (Jun 27)
  • Re: [Slightly OT]: what syslog daemon actually ignores the client timestamp? Andreas Östling (Jun 27)
• arp spoof john (Jun 27)
  • Re: arp spoof John Sage (Jun 28)
  • Re: arp spoof Jeff Nathan (Jun 28)
• OT: decoding a packet to port 1433 Ashley Thomas (Jun 27)
• Snort External Alert Sensors Pathmenanthan Ramakrishna (Jun 28)
• Snort installation Ha Hoang (Jun 28)
  • Re: Snort installation Ralf Hildebrandt (Jun 28)
  • Re: Snort installation Gregory D Hough (Jun 28)
  • <Possible follow-ups>
  • Snort installation Ha Hoang (Jun 28)
    • Re: Snort installation Kistler Ueli (Jun 28)
  • RE: Snort installation Hicks, John (Jun 28)
• RE: Setting up a Windowz Interface to monitor with no IP Address Slighter, Tim (Jun 28)
  • <Possible follow-ups>
  • RE: Setting up a Windowz Interface to monitor with no IP Address Chavez Chris Contr 411 FLTS/TSF (Jun 28)
• Re: Setting up a Windowz Interface to monitor with no IP Address CJATeck (Jun 28)
  • <Possible follow-ups>
  • RE: Setting up a Windowz Interface to monitor with no IP Address McCammon, Keith (Jun 28)
  • Re: Setting up a Windowz Interface to monitor with no IP Address CJATeck (Jun 28)
  • RE: Setting up a Windowz Interface to monitor with no IP Address McCammon, Keith (Jun 28)
  • Re: Setting up a Windowz Interface to monitor with no IP Address CJATeck (Jun 28)
• RE: Setting up a Windowz Interface to monitor with no IP Address Mike Shaw (Jun 28)
• RE: Setting up a Windowz Interface to monitor with no IP Address Slighter, Tim (Jun 28)
  • <Possible follow-ups>
  • RE: Setting up a Windowz Interface to monitor with no IP Address Slighter, Tim (Jun 28)
  • RE: Setting up a Windowz Interface to monitor with no IP Address Hicks, John (Jun 28)
• Network traffic forwarder (hardware device) Lee, Mike (BlackBoard Support) (Jun 28)
  • Re: Network traffic forwarder (hardware device) Erek Adams (Jun 28)
  • <Possible follow-ups>
  • RE: Network traffic forwarder (hardware device) McCammon, Keith (Jun 28)
• Lost ACID database queries KyleGinney (Jun 28)
  • <Possible follow-ups>
  • Re: Lost ACID database queries roman (Jun 28)
• mismatch. Ashley Thomas (Jun 28)
  • Re: mismatch. Ryan Russell (Jun 29)
• snort 99%cpu..not hanging Jonathan (Jun 30)
• XP / Snort / Error opening device Robert Spinelli (Jun 30)
  • Re: XP / Snort / Error opening device Chris Reid (Jun 30)
• Snort architecture- How Detection Engine works? Daniel Lopez (Jun 30)