remove

[Tarek Rached <tarek () skylist net>]

--On Thursday, May 02, 2002 11:38 PM -0700 
snort-users-request () lists sourceforge net wrote:

> Send Snort-users mailing list submissions to
>         snort-users () lists sourceforge net
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://lists.sourceforge.net/lists/listinfo/snort-users
> or, via email, send a message with subject or body 'help' to
>         snort-users-request () lists sourceforge net
>
> You can reach the person managing the list at
>         snort-users-admin () lists sourceforge net
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Snort-users digest..."
>
>
> Today's Topics:
>
>    1. Automating Snort on W2k using WinAt (Brian Ertel)
>    2. Re: Snort DB configuration (Daniel Curry)
>    3. Re: SNMP Problems (Richard Noonan)
>    4. Re: Automating Snort on W2k using WinAt
> (Andrew.Zielinski () bedbath com)    5. SNMP Problems (Groce, Jonathan
> (CRTATL))
>    6. RE: Snort DB configuration (Wirth, Jeff)
>    7. Re: monitoring https / SSL (Jason Haar)
>    8. Re: Automating Snort on W2k using WinAt (Chris Reid)
>    9. Attention Windows Users: Latest Snort 1.87b113 Binaries available -
> Fixed WinPcap Error (Michael Steele)   10. Database maintence scripts
> (Ian Macdonald)
>   11. Help]snort does not run in intrusion detection mode(Bus error) on
> OpenBSD-2.9-Sparc (=?ks_c_5601-1987?B?sei/tby6?=)
>
> --__--__--
>
> Message: 1
> From: Brian Ertel <bsertel () amherst edu>
> To: "'snort-users () lists sourceforge net'"
>          <snort-users () lists sourceforge net>
> Date: Thu, 2 May 2002 15:28:02 -0400
> Subject: [Snort-users] Automating Snort on W2k using WinAt
>
> This is a re-phrasing of a question that went unanswered.
> Using WinAt I want to automate the starting and stopping
> of snort.  I use the snort -de -l c:\inetpub\wwwroot\logs -c snort.conf
> command to start snort.  Usually I manually
> stop snort for ending the process in the
> Task Manager, however that will obviously
> not be a viable option in the automatic process.
> I am using WinAt and a .bat file to start snort at 12:00am
> every day with the above command.  What command can
> I write in a .bat file in order to automatically stop snort before
> 12am everyday using WinAt and a .bat file?
>
>
> Thank you,
>
> Brian
>
> ----------------------------------
> Brian Ertel
> Systems & Networking
> Network Administrator
> Amherst College
> Voice: 413-542-8320
> Fax:    413-542-2626
> bsertel () amherst edu
> ----------------------------------
>
>
>
> --__--__--
>
> Message: 2
> Date: Thu, 02 May 2002 12:51:07 -0700
> From: Daniel Curry <dcurry () corio com>
> To: Mike Macias <mike.macias () caci-nsg com>
> CC: MOHESOWA BYAS <BYASMOHESOWA () sbm intnet mu>,
>         snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Snort DB configuration
>
> This is a multi-part message in MIME format.
> --------------CB33119A75672A3122B78E50
> Content-Type: text/plain; charset=us-ascii
> Content-Transfer-Encoding: 7bit
>
> Mike,
>   That brings up a good question? I had done the
> --with-mysql=/usr/local/mysql
> option and it comes up with missing header. What header is it looking
> for?
>
> --
> Daniel Curry
> DIRECT 650-232-4006
> FAX 650-232-3200
> PGP: B411 A3A5 4699 ED10 6EFA  C9D4 97AE 0A6A 3E56 B485
> --------------CB33119A75672A3122B78E50
> Content-Type: text/x-vcard; charset=us-ascii;
>  name="dcurry.vcf"
> Content-Transfer-Encoding: 7bit
> Content-Description: Card for Daniel Curry
> Content-Disposition: attachment;
>  filename="dcurry.vcf"
>
> begin:vcard
> n:Curry;Daniel
> tel;fax:650-232-3200
> tel;work:650-232-4006
> x-mozilla-html:FALSE
> url:www.corio.com
> org:Corio Inc
> adr:;;959 Skyway Road  Suite 100;San Carlos;California;94070;USA
> version:2.1
> email;internet:dcurry () corio com
> title:Sr. Information Security Eng.
> x-mozilla-cpt:;-5312
> fn:Daniel Curry
> end:vcard
>
> --------------CB33119A75672A3122B78E50--
>
>
>
> --__--__--
>
> Message: 3
> From: Richard Noonan <rnoonan () interops com>
> Reply-To: rnoonan () interops com
> Organization: IOPS
> To: "Leandro A Ferreira" <pivetta () br ibm com>,
>    "snort-users () lists sourceforge net" <snort-users () lists sourceforge net>
> Subject: Re: [Snort-users] SNMP Problems
> Date: Thu, 2 May 2002 16:19:35 -0400
>
> On Thursday 02 May 2002 01:14, Leandro A Ferreira wrote:
> <edit>
> > /usr/local/lib/libsnmp.so: undefined reference to `EVP_DigestInit'
> > /usr/local/lib/libsnmp.so: undefined reference to `EVP_DigestFinal'
> > /usr/local/lib/libsnmp.so: undefined reference to `EVP_md5'
> > /usr/local/lib/libsnmp.so: undefined reference to `HMAC'
> > /usr/local/lib/libsnmp.so: undefined reference to `EVP_sha1'
> > /usr/local/lib/libsnmp.so: undefined reference to `des_cbc_encrypt'
> > /usr/local/lib/libsnmp.so: undefined reference to `des_key_sched'
> > /usr/local/lib/libsnmp.so: undefined reference to `EVP_DigestUpdate'
> > /usr/local/lib/libsnmp.so: undefined reference to `RAND_bytes'
> > /usr/local/lib/libsnmp.so: undefined reference to `des_ncbc_encrypt'
> > collect2: ld returned 1 exit status
> > make[2]: *** [snort] Error 1
> > make[2]: Leaving directory `/home/luizn/snort-1.8.6'
> > make[1]: *** [all-recursive] Error 1
> > make[1]: Leaving directory `/home/luizn/snort-1.8.6'
> > make: *** [all-recursive-am] Error 2
> >
> >
> > How is my problem?
>
> ./configure --with-snmp --with-ssl
>
> I had the same problem and this solved it.
>
>
> --__--__--
>
> Message: 4
> Subject: Re: [Snort-users] Automating Snort on W2k using WinAt
> To: Brian Ertel <bsertel () amherst edu>
> Cc: snort-users () lists sourceforge net
> From: Andrew.Zielinski () bedbath com
> Date: Thu, 2 May 2002 16:23:12 -0400
>
>
> Brian,
>      Not sure if this will help, but I use a scheduling program called
> JIT. It does allow you to kill a proccess after a certain period of time.
> Originally this program was free, with the latest release there is a very
> reasonable fee. You can find it at.
>
> http://gibinsoft.net/hp/polyakoff/
>
> Andrew Zielinski
>
>
>
>                      Brian Ertel
>                      <bsertel () amherst edu>                To:
> "'snort-users () lists sourceforge net'"                             Sent
> by:                             <snort-users () lists sourceforge net>
>                      snort-users-admin@lists.sourc        cc:
>                      eforge.net                           Subject:
> [Snort-users] Automating Snort on W2k
> using WinAt
>                      05/02/2002 03:28 PM
>
>
>
>
>
>
>
> This is a re-phrasing of a question that went unanswered.
> Using WinAt I want to automate the starting and stopping
> of snort.  I use the snort -de -l c:\inetpub\wwwroot\logs -c snort.conf
> command to start snort.  Usually I manually
> stop snort for ending the process in the
> Task Manager, however that will obviously
> not be a viable option in the automatic process.
> I am using WinAt and a .bat file to start snort at 12:00am
> every day with the above command.  What command can
> I write in a .bat file in order to automatically stop snort before
> 12am everyday using WinAt and a .bat file?
>
>
> Thank you,
>
> Brian
>
> ----------------------------------
> Brian Ertel
> Systems & Networking
> Network Administrator
> Amherst College
> Voice: 413-542-8320
> Fax:    413-542-2626
> bsertel () amherst edu
> ----------------------------------
>
>
> _______________________________________________________________
>
> Have big pipes? SourceForge.net is looking for download mirrors. We supply
> the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
>
>
>
> --__--__--
>
> Message: 5
> From: "Groce, Jonathan (CRTATL)" <Jonathan.Groce () concert com>
> To: "'snort-users () lists sourceforge net'"
>          <snort-users () lists sourceforge net>
> Date: Thu, 2 May 2002 16:31:53 -0400
> Subject: [Snort-users] SNMP Problems
>
> It worked for me when I used "./configure --with-snmp --with-openssl"
> after having the same problem as you have specified.
> Regards,
>  Jon Groce
> BT Network Integrity Assurance
> jonathan.groce () concert com
> voice +1 770.333.4629
> group +1 678.556.6555
> fax  +1 678.556.6849
>
>
> -----Original Message-----
> To: "snort-users () lists sourceforge net"
> <snort-users () lists sourceforge net> From: "Leandro A Ferreira"
> <pivetta () br ibm com>
> Date: Thu, 2 May 2002 17:14:28 +0000
> Subject: [Snort-users] SNMP Problems
>
> hi
>
> Try to compile my snort from --with-snmp and received the following
> message:
>
> gcc  -g -O2 -Wall -L/usr/local/lib  -o snort  snort.o log.o decode.o
> mstring.o rules.o plugbase.o sp_pattern_match.o sp_tcp_flag_check.o
> sp_icmp_type_check.o sp_icmp_code_check.o sp_ttl_check.o sp_ip_id_check.o
> sp_tcp_ack_check.o sp_tcp_seq_check.o sp_dsize_check.o spp_http_decode.o
> spp_portscan.o sp_ipoption_check.o sp_rpc_check.o sp_icmp_id_check.o
> sp_icmp_seq_check.o sp_respond.o spo_alert_syslog.o spo_log_tcpdump.o
> spo_database.o sp_session.o spp_defrag.o parser.o spo_alert_fast.o
> spo_alert_full.o spo_alert_smb.o spo_alert_unixsock.o sp_react.o spo_xml.o
> sp_ip_tos_check.o snprintf.o checksum.o spp_tcp_stream2.o sp_reference.o
> sp_ip_fragbits.o spp_anomsensor.o tag.o spp_unidecode.o codes.o strlcpyu.o
> strlcatu.o debug.o sp_tcp_win_check.o spp_rpc_decode.o spp_bo.o
> spp_telnet_negotiation.o spo_csv.o sp_ip_same_check.o sp_priority.o
> sp_ip_proto.o ubi_BinTree.o ubi_SplayTree.o spo_unified.o spp_stream4.o
> spp_frag2.o spp_arpspoof.o spo_idmef.o spo_SnmpTrap.o spo_log_null.o
> -lpcap -lm -lnsl  -lsnmp
> /usr/local/lib/libsnmp.so: undefined reference to `EVP_DigestInit'
> /usr/local/lib/libsnmp.so: undefined reference to `EVP_DigestFinal'
> /usr/local/lib/libsnmp.so: undefined reference to `EVP_md5'
> /usr/local/lib/libsnmp.so: undefined reference to `HMAC'
> /usr/local/lib/libsnmp.so: undefined reference to `EVP_sha1'
> /usr/local/lib/libsnmp.so: undefined reference to `des_cbc_encrypt'
> /usr/local/lib/libsnmp.so: undefined reference to `des_key_sched'
> /usr/local/lib/libsnmp.so: undefined reference to `EVP_DigestUpdate'
> /usr/local/lib/libsnmp.so: undefined reference to `RAND_bytes'
> /usr/local/lib/libsnmp.so: undefined reference to `des_ncbc_encrypt'
> collect2: ld returned 1 exit status
> make[2]: *** [snort] Error 1
> make[2]: Leaving directory `/home/luizn/snort-1.8.6'
> make[1]: *** [all-recursive] Error 1
> make[1]: Leaving directory `/home/luizn/snort-1.8.6'
> make: *** [all-recursive-am] Error 2
>
>
> How is my problem?
>
>
>
>
>
> -- __--__--
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-users
>
>
> End of Snort-users Digest
>
>
> This email and any files transmitted with it are confidential
> and intended solely for the use of the individual or entity
> to whom they are addressed.
>
> This email message has been swept by Sybari Antigen
> for the presence of computer viruses.
>
>
> --__--__--
>
> Message: 6
> From: "Wirth, Jeff" <WirthJe () DNB com>
> To: "'Daniel Curry'" <dcurry () corio com>
> Cc: snort-users () lists sourceforge net
> Subject: RE: [Snort-users] Snort DB configuration
> Date: Thu, 2 May 2002 16:32:42 -0400
>
> From: Daniel Curry [mailto:dcurry () corio com]
> > Mike,
> >   That brings up a good question? I had done the
> > --with-mysql=/usr/local/mysql
> > option and it comes up with missing header. What header is it looking
> > for?
>
> That would be mysql.h, which is located wherever your mysql include files
> where dropped.
>
> - jeff
>
>
> --__--__--
>
> Message: 7
> Date: Fri, 3 May 2002 08:39:15 +1200
> From: Jason Haar <Jason.Haar () trimble co nz>
> To: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] monitoring https / SSL
> Organization: Trimble Navigation New Zealand Ltd.
>
> On Thu, May 02, 2002 at 12:51:02PM -0400, Slade Edmonds wrote:
> > Could anyone direct me to information regarding snorting SSL traffic?
> > Is it just a matter of taking the rules files designed for monitoring
> > standard http port 80 and adding an ssl port to it?
>
> Reverse proxies are your friends...
>
> The world talks to you SSL servers, which in reality are reverse proxies
> and they talk standard HTTP back to the real backend servers. Snort sits
> in between, and can monitor the HTTP traffic.
>
> Works well :-)
>
> --
> Cheers
>
> Jason Haar
>
> Information Security Manager
> Trimble Navigation Ltd.
> Phone: +64 3 9635 377 Fax: +64 3 9635 417
>
>
> --__--__--
>
> Message: 8
> From: "Chris Reid" <Chris.Reid () CodeCraftConsultants com>
> To: "Brian Ertel" <bsertel () amherst edu>,
>         <Andrew.Zielinski () bedbath com>
> Cc: <snort-users () lists sourceforge net>
> Subject: Re: [Snort-users] Automating Snort on W2k using WinAt
> Date: Thu, 2 May 2002 15:56:11 -0600
>
> If you have access to Visual Studio, you may want to download and compile
> the snort 1.9 source code (http://www.snort.org/devel.html).  I've added
> support for running snort as a Windows service.  Now at scheduled times
> (ie using WinAt) you can run commands like "net stop snortsvc" or "net
> start snortsvc".
>
> Install the service by running the command:
>
>     snort /SERVICE /INSTALL any_of_your_regular_parameters
>
> Then you can issue the "net" commands (describe above), or alternately you
> can use the Services control panel.
>
> Chris Reid
>
>
> ----- Original Message -----
> From: <Andrew.Zielinski () bedbath com>
> To: "Brian Ertel" <bsertel () amherst edu>
> Cc: <snort-users () lists sourceforge net>
> Sent: Thursday, May 02, 2002 2:23 PM
> Subject: Re: [Snort-users] Automating Snort on W2k using WinAt
>
>
> > Brian,
> >      Not sure if this will help, but I use a scheduling program called
> JIT.
> > It does allow you to kill a proccess after a certain period of time.
> > Originally this program was free, with the latest release there is a very
> > reasonable fee. You can find it at.
> >
> > http://gibinsoft.net/hp/polyakoff/
> >
> > Andrew Zielinski
> >
> >
> >
> >                     Brian Ertel
> >                     <bsertel () amherst edu>                To:
> "'snort-users () lists sourceforge net'"
> >                     Sent by:
> <snort-users () lists sourceforge net>
> >                     snort-users-admin@lists.sourc        cc:
> >                     eforge.net                           Subject:
> [Snort-users] Automating Snort on W2k
> >                                                          using WinAt
>
> >                     05/02/2002 03:28 PM
> >
> >
> >
> >
> >
> >
> > This is a re-phrasing of a question that went unanswered.
> > Using WinAt I want to automate the starting and stopping
> > of snort.  I use the snort -de -l c:\inetpub\wwwroot\logs -c snort.conf
> > command to start snort.  Usually I manually
> > stop snort for ending the process in the
> > Task Manager, however that will obviously
> > not be a viable option in the automatic process.
> > I am using WinAt and a .bat file to start snort at 12:00am
> > every day with the above command.  What command can
> > I write in a .bat file in order to automatically stop snort before
> > 12am everyday using WinAt and a .bat file?
> >
> >
> > Thank you,
> >
> > Brian
> >
> > ----------------------------------
> > Brian Ertel
> > Systems & Networking
> > Network Administrator
> > Amherst College
> > Voice: 413-542-8320
> > Fax:    413-542-2626
> > bsertel () amherst edu
> > ----------------------------------
> >
> >
> > _______________________________________________________________
> >
> > Have big pipes? SourceForge.net is looking for download mirrors. We
> > supply the hardware. You get the recognition. Email Us:
> > bandwidth () sourceforge net _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> >
> >
> >
> >
> > _______________________________________________________________
> >
> > Have big pipes? SourceForge.net is looking for download mirrors. We
> > supply the hardware. You get the recognition. Email Us:
> > bandwidth () sourceforge net _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
>
> --__--__--
>
> Message: 9
> From: "Michael Steele" <michaels () silicondefense com>
> To: <snort-users () lists sourceforge net>
> Date: Thu, 2 May 2002 17:41:08 -0700
> Subject: [Snort-users] Attention Windows Users: Latest Snort 1.87b113
> Binaries available - Fixed WinPcap Error
>
> To all Windows users of Snort:
>
> Please read all the notices below.
>
> NOTICE: Silicon Defense has patched this release to fix a problem with
> Snort when using WinPcap v2.3 and the open adapter error (when you do a
> "snort -W" the list of adapter's shows ONLY "1" and nothing else). There
> is NO official support for this fix. The fix has been submitted to the
> CVS tree by Chris Reid but has yet to be added. Any problems, please
> directly email me.
>
> The latest 1.8.7b113 binaries have been compiled and are now available
> on our site. There are 5 flavors available:
>
> Snort 1.8.7b113 Release
> Snort 1.8.7b113 MySQL Release
> Snort 1.8.7b113 MySQL/FlexResp Release
> Snort 1.8.7b113 FlxResp Release
> Snort 1.8.7b113 MSSQL Release
>
> NOTICE: The latest WinPcap has gone gold! Version 2.3
> http://netgroup-serv.polito.it/winpcap/
>
> NOTICE: LibnetNT.dll can be found at:
> http://www.securitybugware.org/libnetnt/
>
> NOTICE to all our clients: We will ONLY be supporting the RELEASE
> versions of Snort 1.7.1, Snort 1.8.1, Snort 1.8.2, 1.8.3, and 1.86 at
> this time.
>
> Link to Downloads:
> http://www.silicondefense.com/techsupport/downloads.htm
>
> Link to Documentation:
> http://www.silicondefense.com/techsupport/windows.htm
>
> Michael Steele | Support Technician
> mailto:michaels () silicondefense com
> Silicon Defense: IDS solutions - http://www.silicondefense.com
> Snort: Open Source Network IDS - http://www.snort.org
>
>
>
>
> --__--__--
>
> Message: 10
> Date: Thu, 2 May 2002 21:58:49 -0500 (EST)
> From: Ian Macdonald <secsnort () dirk demon co uk>
> To: <snort-users () lists sourceforge net>
> Subject: [Snort-users] Database maintence scripts
>
> I had a snort mysql database that was huge so I wrote some scripts to
> archive the data. I thought I would share them with everyone.
>
> they are available at www.dirk.demon.co.uk/utils/snort-maint.zip
>
> You need to run create_table.sql in your snort database to create
> arch_data
> arch_event
> arch_icmphdr
> arch_iphdr
> arch_opt
> arch_tcphdr
> arch_udphdr
> arch_timestamp
>
> then you can edit run.sh on unix or run.bat to set your username and
> password etc.
>
> When you run the scripts it will copy all data older than 7 days from
> event,icmphdr,iphdr,opt,tcphdr and udphdr to the arch_ tables then delete
> the data.
>
> If you can change the time period by editing stage1.sql.
>
> I haven't done much testing so use at your own risk.
>
> If you find any problems please let me know
>
> Ian
>
>
>
>
> --__--__--
>
> Message: 11
> From: =?ks_c_5601-1987?B?sei/tby6?= <youngsung.kim () hynix com>
> To: <snort-users () lists sourceforge net>
> Date: Fri, 3 May 2002 15:36:55 +0900
> Subject: [Snort-users] Help]snort does not run in intrusion detection
> mode(Bus error) on OpenBSD-2.9-Sparc
>
> This is a multi-part message in MIME format.
>
> ------=_NextPart_000_000F_01C1F2B8.5B152060
> Content-Type: text/plain;
>         charset="ks_c_5601-1987"
> Content-Transfer-Encoding: base64
>
> SSByYW4gc25vcnQgb24gT3BlbkJTRC0yLjktc3BhcmMuIEl0IHdhcyBjb21waWxlZCB3ZWxsI
> Hdp
> dGggaW5jbHVkZWQgY29tcGlsZXIuDQpJbiBzbmlmZmluZyBtb2RlIGFuZCBwYWNrZXQgbG9nZ
> 2Vy
> IG1vZGUgc25vcnQgcnVucyB3ZWxsLiANCkJ1dCBpbiBOSUQgbW9kZSwgaXQgZGlkbid0IHJ1b
> i4g
> QW5kIHRoZW4gc25vcnQuY29yZSBnZXJlcmF0ZWQuDQooRXhdL3Vzci9zbm9ydC9iaW4vc25vc
> nQg
> LWRldiAtbCAuL2xvZyAtYyAvdXNyL3Nub3J0L3J1bGVzL3Nub3J0LmNvbmYpDQoNCkhlcmUga
> XMg
> b3V0IHdpdGggImdkYiBzbm9ydCINCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
> S0t
> LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQppZHNob3N0IyBnZGIgc25vc
> nQN
> CkdOVSBnZGIgNC4xNi4xDQpDb3B5cmlnaHQgMTk5NiBGcmVlIFNvZnR3YXJlIEZvdW5kYXRpb
> 24s
> IEluYy4NCkdEQiBpcyBmcmVlIHNvZnR3YXJlLCBjb3ZlcmVkIGJ5IHRoZSBHTlUgR2VuZXJhb
> CBQ
> dWJsaWMgTGljZW5zZSwgYW5kIHlvdSBhcmUNCndlbGNvbWUgdG8gY2hhbmdlIGl0IGFuZC9vc
> iBk
> aXN0cmlidXRlIGNvcGllcyBvZiBpdCB1bmRlciBjZXJ0YWluIGNvbmRpdGlvbnMuDQpUeXBlI
> CJz
> aG93IGNvcHlpbmciIHRvIHNlZSB0aGUgY29uZGl0aW9ucy4NClRoZXJlIGlzIGFic29sdXRlb
> Hkg
> bm8gd2FycmFudHkgZm9yIEdEQi4gIFR5cGUgInNob3cgd2FycmFudHkiIGZvciBkZXRhaWxzL
> g0K
> VGhpcyBHREIgd2FzIGNvbmZpZ3VyZWQgYXMgInNwYXJjLXVua25vd24tb3BlbmJzZDIuOSIuL
> i4N
> CihnZGIpIHJ1biAtZGV2IC1sIC4vbG9nIC1jIC91c3Ivc25vcnQvcnVsZXMvc25vcnQuY29uZ
> g0K
> U3RhcnRpbmcgcHJvZ3JhbTogL3Vzci9zbm9ydC9iaW4vc25vcnQgLWRldiAtbCAuL2xvZyAtY
> yAv
> dXNyL3Nub3J0L3J1bGVzL3Nub3J0LmNvbmYNCkxvZyBkaXJlY3RvcnkgPSAuL2xvZw0KDQpJb
> ml0
> aWFsaXppbmcgTmV0d29yayBJbnRlcmZhY2UgaG1lMA0KDQogICAgICAgIC0tPT0gSW5pdGlhb
> Gl6
> aW5nIFNub3J0ID09LS0NCkRlY29kaW5nIEV0aGVybmV0IG9uIGludGVyZmFjZSBobWUwDQpJb
> ml0
> aWFsaXppbmcgUHJlcHJvY2Vzc29ycyENCkluaXRpYWxpemluZyBQbHVnLWlucyENCkluaXRpY
> Wxp
> emF0aW5nIE91dHB1dCBQbHVnaW5zIQ0KUGFyc2luZyBSdWxlcyBmaWxlIC91c3Ivc25vcnQvc
> nVs
> ZXMvc25vcnQuY29uZg0KDQorKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrK
> ysr
> KysrKysrKysrKysNCkluaXRpYWxpemluZyBydWxlIGNoYWlucy4uLg0KTm8gYXJndW1lbnRzI
> HRv
> IGZyYWcyIGRpcmVjdGl2ZSwgc2V0dGluZyBkZWZhdWx0cyB0bzoNCiAgICBGcmFnbWVudCB0a
> W1l
> b3V0OiA2MCBzZWNvbmRzDQogICAgRnJhZ21lbnQgbWVtb3J5IGNhcDogNDE5NDMwNCBieXRlc
> w0K
> U3RyZWFtNCBjb25maWc6DQogICAgU3RhdGVmdWwgaW5zcGVjdGlvbjogQUNUSVZFDQogICAgU
> 2Vz
> c2lvbiBzdGF0aXN0aWNzOiBJTkFDVElWRQ0KICAgIFNlc3Npb24gdGltZW91dDogMzAgc2Vjb
> 25k
> cw0KICAgIFNlc3Npb24gbWVtb3J5IGNhcDogODM4ODYwOCBieXRlcw0KICAgIFN0YXRlIGFsZ
> XJ0
> czogSU5BQ1RJVkUNCiAgICBTY2FuIGFsZXJ0czogQUNUSVZFDQogICAgTG9nIEZsdXNoZWQgU
> 3Ry
> ZWFtczogSU5BQ1RJVkUNCg0KUHJvZ3JhbSByZWNlaXZlZCBzaWduYWwgU0lHQlVTLCBCdXMgZ
> XJy
> b3IuDQoweDQ2ZDc4IGluIEluaXRTdHJlYW00UGt0ICgpIGF0IHNwcF9zdHJlYW00LmM6MjkzO
> A0K
> MjkzOCAgICAgICAgc3RyZWFtX3BrdC0+aXBoLT5pcF92ZXIgICA9IDB4NDsNCi0tLS0tLS0tL
> S0t
> LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
> S0t
> LS0tLS0tLS0tDQoNCkhvdyBjb3VsZCBJIGZpeCBpdC4gQW55b25lIGNhbiBoZWxwIG1lPy4gV
> Ghh bmtzLg==
>
> ------=_NextPart_000_000F_01C1F2B8.5B152060
> Content-Type: text/html;
>         charset="ks_c_5601-1987"
> Content-Transfer-Encoding: base64
>
> PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uY
> Wwv
> L0VOIj4NCjxIVE1MPjxIRUFEPg0KPE1FVEEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29ud
> GVu
> dD0idGV4dC9odG1sOyBjaGFyc2V0PWtzX2NfNTYwMS0xOTg3Ij4NCjxNRVRBIGNvbnRlbnQ9I
> k1T
> SFRNTCA1LjUwLjQ5MTUuNTAwIiBuYW1lPUdFTkVSQVRPUj4NCjxTVFlMRT48L1NUWUxFPg0KP
> C9I
> RUFEPg0KPEJPRFkgYmdDb2xvcj0jZmZmZmZmPg0KPERJVj48Rk9OVCBzaXplPTI+SSByYW4gc
> 25v
> cnQgb24gT3BlbkJTRC0yLjktc3BhcmMuIEl0IHdhcyBjb21waWxlZCB3ZWxsIHdpdGggDQppb
> mNs
> dWRlZCBjb21waWxlci48L0ZPTlQ+PC9ESVY+DQo8RElWPjxGT05UIHNpemU9Mj5JbiBzbmlmZ
> mlu
> ZyBtb2RlIGFuZCBwYWNrZXQgbG9nZ2VyIG1vZGUgPC9GT05UPjxGT05UIA0Kc2l6ZT0yPnNub
> 3J0
> IHJ1bnMgd2VsbC4gPC9GT05UPjwvRElWPg0KPERJVj48Rk9OVCBzaXplPTI+QnV0IGluIE5JR
> CBt
> b2RlLCBpdCBkaWRuJ3QgcnVuLiBBbmQgdGhlbiBzbm9ydC5jb3JlIA0KZ2VyZXJhdGVkLjwvR
> k9O
> VD48L0RJVj4NCjxESVY+PEZPTlQgc2l6ZT0yPihFeF0vdXNyL3Nub3J0L2Jpbi9zbm9ydCAtZ
> GV2
> IC1sIC4vbG9nIC1jIA0KL3Vzci9zbm9ydC9ydWxlcy9zbm9ydC5jb25mKTwvRk9OVD48L0RJV
> j4N
> CjxESVY+PEZPTlQgc2l6ZT0yPjwvRk9OVD4mbmJzcDs8L0RJVj4NCjxESVY+PEZPTlQgc2l6Z
> T0y
> PkhlcmUgaXMgb3V0IHdpdGggImdkYiBzbm9ydCI8L0ZPTlQ+PC9ESVY+DQo8RElWPjxGT05UI
> A0K
> c2l6ZT0yPi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
> S0t
> LS0tLS0tLS0tLS0tLS0tLS0tLS0tPC9GT05UPjwvRElWPg0KPERJVj48Rk9OVCBzaXplPTI+a
> WRz
> aG9zdCMgZ2RiIHNub3J0PEJSPkdOVSBnZGIgNC4xNi4xPEJSPkNvcHlyaWdodCAxOTk2IEZyZ
> WUg
> DQpTb2Z0d2FyZSBGb3VuZGF0aW9uLCBJbmMuPEJSPkdEQiBpcyBmcmVlIHNvZnR3YXJlLCBjb
> 3Zl
> cmVkIGJ5IHRoZSBHTlUgR2VuZXJhbCANClB1YmxpYyBMaWNlbnNlLCBhbmQgeW91IGFyZTxCU
> j53
> ZWxjb21lIHRvIGNoYW5nZSBpdCBhbmQvb3IgZGlzdHJpYnV0ZSBjb3BpZXMgb2YgDQppdCB1b
> mRl
> ciBjZXJ0YWluIGNvbmRpdGlvbnMuPEJSPlR5cGUgInNob3cgY29weWluZyIgdG8gc2VlIHRoZ
> SAN
> CmNvbmRpdGlvbnMuPEJSPlRoZXJlIGlzIGFic29sdXRlbHkgbm8gd2FycmFudHkgZm9yIEdEQ
> i4m
> bmJzcDsgVHlwZSAic2hvdyANCndhcnJhbnR5IiBmb3IgZGV0YWlscy48QlI+VGhpcyBHREIgd
> 2Fz
> IGNvbmZpZ3VyZWQgYXMgDQoic3BhcmMtdW5rbm93bi1vcGVuYnNkMi45Ii4uLjxCUj4oZ2RiK
> SBy
> dW4gLWRldiAtbCAuL2xvZyAtYyANCi91c3Ivc25vcnQvcnVsZXMvc25vcnQuY29uZjxCUj5Td
> GFy
> dGluZyBwcm9ncmFtOiAvdXNyL3Nub3J0L2Jpbi9zbm9ydCAtZGV2IC1sIA0KLi9sb2cgLWMgL
> 3Vz
> ci9zbm9ydC9ydWxlcy9zbm9ydC5jb25mPEJSPkxvZyBkaXJlY3RvcnkgPSAuL2xvZzwvRk9OV
> D48
> L0RJVj4NCjxESVY+Jm5ic3A7PC9ESVY+DQo8RElWPjxGT05UIHNpemU9Mj5Jbml0aWFsaXppb
> mcg
> TmV0d29yayBJbnRlcmZhY2UgaG1lMDwvRk9OVD48L0RJVj4NCjxESVY+Jm5ic3A7PC9ESVY+D
> Qo8
> RElWPjxGT05UIHNpemU9Mj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmb
> mJz
> cDsgLS09PSBJbml0aWFsaXppbmcgDQpTbm9ydCA9PS0tPEJSPkRlY29kaW5nIEV0aGVybmV0I
> G9u
> IGludGVyZmFjZSBobWUwPEJSPkluaXRpYWxpemluZyANClByZXByb2Nlc3NvcnMhPEJSPklua
> XRp
> YWxpemluZyBQbHVnLWlucyE8QlI+SW5pdGlhbGl6YXRpbmcgT3V0cHV0IA0KUGx1Z2lucyE8Q
> lI+
> UGFyc2luZyBSdWxlcyBmaWxlIC91c3Ivc25vcnQvcnVsZXMvc25vcnQuY29uZjwvRk9OVD48L
> 0RJ
> Vj4NCjxESVY+Jm5ic3A7PC9ESVY+DQo8RElWPjxGT05UIA0Kc2l6ZT0yPisrKysrKysrKysrK
> ysr
> KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKzxCUj5Jbml0aWFsaXppbmcgc
> nVs
> ZSANCmNoYWlucy4uLjxCUj5ObyBhcmd1bWVudHMgdG8gZnJhZzIgZGlyZWN0aXZlLCBzZXR0a
> W5n
> IGRlZmF1bHRzIA0KdG86PEJSPiZuYnNwOyZuYnNwOyZuYnNwOyBGcmFnbWVudCB0aW1lb3V0O
> iA2
> MCBzZWNvbmRzPEJSPiZuYnNwOyZuYnNwOyZuYnNwOyANCkZyYWdtZW50IG1lbW9yeSBjYXA6I
> DQx
> OTQzMDQgYnl0ZXM8QlI+U3RyZWFtNCBjb25maWc6PEJSPiZuYnNwOyZuYnNwOyZuYnNwOyANC
> lN0
> YXRlZnVsIGluc3BlY3Rpb246IEFDVElWRTxCUj4mbmJzcDsmbmJzcDsmbmJzcDsgU2Vzc2lvb
> iBz
> dGF0aXN0aWNzOiANCklOQUNUSVZFPEJSPiZuYnNwOyZuYnNwOyZuYnNwOyBTZXNzaW9uIHRpb
> WVv
> dXQ6IDMwIHNlY29uZHM8QlI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IA0KU2Vzc2lvbiBtZW1vcnkgY
> 2Fw
> OiA4Mzg4NjA4IGJ5dGVzPEJSPiZuYnNwOyZuYnNwOyZuYnNwOyBTdGF0ZSBhbGVydHM6IA0KS
> U5B
> Q1RJVkU8QlI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IFNjYW4gYWxlcnRzOiBBQ1RJVkU8QlI+Jm5ic
> 3A7
> Jm5ic3A7Jm5ic3A7IExvZyANCkZsdXNoZWQgU3RyZWFtczogSU5BQ1RJVkU8L0ZPTlQ+PC9ES
> VY+
> DQo8RElWPiZuYnNwOzwvRElWPg0KPERJVj48Rk9OVCBzaXplPTI+UHJvZ3JhbSByZWNlaXZlZ
> CBz
> aWduYWwgU0lHQlVTLCBCdXMgZXJyb3IuPEJSPjB4NDZkNzggaW4gDQpJbml0U3RyZWFtNFBrd
> CAo
> KSBhdCANCnNwcF9zdHJlYW00LmM6MjkzODxCUj4yOTM4Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic
> 3A7
> Jm5ic3A7Jm5ic3A7Jm5ic3A7IA0Kc3RyZWFtX3BrdC0mZ3Q7aXBoLSZndDtpcF92ZXImbmJzc
> Dsm
> bmJzcDsgPSANCjB4NDs8QlI+LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tL
> S0t
> LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS08L0ZPTlQ+PC9ESVY+DQo8R
> ElW
> PjxGT05UIHNpemU9Mj48L0ZPTlQ+Jm5ic3A7PC9ESVY+DQo8RElWPjxGT05UIHNpemU9Mj5Ib
> 3cg
> Y291bGQgSSBmaXggaXQuIEFueW9uZSBjYW4gaGVscCBtZT8uIA0KVGhhbmtzLjwvRk9OVD48L
> 0RJ Vj48L0JPRFk+PC9IVE1MPg0K
>
> ------=_NextPart_000_000F_01C1F2B8.5B152060--
>
>
>
>
>
> --__--__--
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-users
>
>
> End of Snort-users Digest



_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users