Snort: by author

• RSS Feed
• About List
• All Lists

Previous period

Next period

2504 messages starting May 02 02 and ending Apr 19 02
Date index | Thread index | Author index

김영성

Help]snort does not run in intrusion detection mode(Bus error) on OpenBSD-2.9-Sparc 김영성 (May 02)

Aaron Richard Walters

Re: Using Snort for Wireless Aaron Richard Walters (Apr 04)

Abe L. Getchell

RE: (ot) how to get alert size? Abe L. Getchell (May 28)

Abe Wagner

"id command attempt" malformed packet Abe Wagner (May 11)

Adam Migus

RE: sorry...upgrade question again Adam Migus (May 29)

Addam Schroll

Re: Snort & Acid on OpenBSD 3.1? Addam Schroll (Jun 06)

Adrian Voinea

Re: How to ignore scan from a host Adrian Voinea (Jun 01)

Aidan Carty

Snort install document for peer review. Aidan Carty (Apr 23)
Snort installation document for review. Aidan Carty (Apr 22)

Alan_Kloster

Snort rule for detecting wireless 802.11b transmissions Alan_Kloster (May 18)
Freebsd Snort starts with no errors but goes to bpf in top 0% cpu Alan_Kloster (Apr 25)
How to Craft a rule that negates multiple ports?? Alan_Kloster (May 29)
RE: Freebsd Snort starts with no errors but goes to bpf in top 0% cpu Alan_Kloster (Apr 26)
Mysql dbschema changed again? How to upgrade? Alan_Kloster (Apr 14)

Alberto Dainotti

Re: No more -z all? Alberto Dainotti (May 11)

Alejandro Flores

Re: Odd question... Alejandro Flores (Apr 30)
KLEZ Alejandro Flores (Apr 25)
Re: Problem getting Snort to Connect to PostgreSQL database Alejandro Flores (May 15)

Alex Pinheiro Machado Rodrigues

Re: configure snort to drop payloads Alex Pinheiro Machado Rodrigues (Apr 18)
Re: excluding a host from rule Alex Pinheiro Machado Rodrigues (May 30)
Re: Mysql problem Alex Pinheiro Machado Rodrigues (Jun 22)
Re: ACID Problem Alex Pinheiro Machado Rodrigues (May 15)
Snort in Brazil Alex Pinheiro Machado Rodrigues (Apr 18)
Re: Wireless monitoring Alex Pinheiro Machado Rodrigues (May 22)

Ali Dogru

Error if I start snort Ali Dogru (Apr 15)
Example Script for Snort Ali Dogru (Apr 28)

AlinC

Compiling snort AlinC (May 03)

Alwin Raymundo

switch Alwin Raymundo (May 15)
Re: Flexresp problem Alwin Raymundo (Apr 20)
another switch question Alwin Raymundo (May 16)
RE: Flexresp Alwin Raymundo (Apr 08)
Re: snort & mysql Alwin Raymundo (Apr 14)
Alerting Snort (sending alert through pager) Alwin Raymundo (May 03)
Re: Flexresp Alwin Raymundo (Apr 09)
RE: Alerting Snort (sending alert through pager) Alwin Raymundo (May 06)
Compilation Error Alwin Raymundo (Jun 10)
RE: Thoughts on internal vs. external IDS rulesets Alwin Raymundo (Apr 11)
spp_portscan and ACID Alwin Raymundo (Apr 04)
Re: Flexresp Alwin Raymundo (Apr 08)
Flexresp Alwin Raymundo (Apr 08)
RE: Flexresp Alwin Raymundo (Apr 09)
Re: AW: another switch question Alwin Raymundo (May 16)
Re: Compilation Error Alwin Raymundo (Jun 11)

Andrea

Problem with Demarc Andrea (Apr 06)

Andrea Barisani

Firewall Tester 0.6 Andrea Barisani (Apr 09)
Firewall Tester 0.7 Andrea Barisani (May 30)
Re: Testing tools Andrea Barisani (Jun 16)

Andreas Czerniak

IP-Field logging: Padding ? Andreas Czerniak (May 07)

Andreas Hasenack

Re: ACID slow to bring up packet details - running on W2K with MS-SQL 2000 SP2 Andreas Hasenack (May 13)
Tagging and Acid Andreas Hasenack (May 21)

Andreas Krassek

unsubscribe Andreas Krassek (Jun 18)

Andreas Östling

Re: [Slightly OT]: what syslog daemon actually ignores the client timestamp? Andreas Östling (Jun 27)
Oinkmaster v0.5 Andreas Östling (May 06)
Re: [unisog] Solaris system compromised via telnet. New exploit? Andreas Östling (Apr 26)
RE: Curse of the cmd.exe Andreas Östling (Jun 15)
RE: Snort rules touble. Andreas Östling (Jun 21)
Re: Errors when initiating my sensors. Andreas Östling (May 01)
Re: Problem with a rule Andreas Östling (Apr 10)
Re: Snort 99% cpu utilization and no process activity Andreas Östling (Apr 05)
Re: Best snort list replier / contributor Andreas Östling (Apr 15)
Re: Snort at boot Andreas Östling (Jun 18)
Re: Need help with a rule Andreas Östling (Apr 10)
Re: interface name in alert? Andreas Östling (Apr 11)
Oinkmaster v0.4 Andreas Östling (Apr 22)
Re: All shellcode rules invalid Andreas Östling (Apr 13)
Re: snort 1.8.6 crashing when running two instances on the same interface with Openbsd Andreas Östling (Apr 16)
Re: Signature for Snort 1.8.x Andreas Östling (May 13)
Re: What's the fuss about string matching ? Andreas Östling (May 27)

Andreu . Gomez

Re: ACID + Snort 1.8.6 + Apache 2.0 + PHP 4.2.0 RC 4 Andreu . Gomez (Apr 15)
Re: what would be the effect? Andreu . Gomez (Apr 09)
Re: content-list rule won't work Andreu . Gomez (Apr 05)
Re: Network Adapter failed with snort ! Andreu . Gomez (Apr 16)
Re: DOS MSDTC attempt Andreu . Gomez (Apr 17)
Re: SnortSnarf Compile error Andreu . Gomez (Apr 22)
Re: acid on RH7.2 Andreu . Gomez (Apr 11)
Re: can't start snort Andreu . Gomez (Apr 11)
Re: ACID Database Error Andreu . Gomez (Apr 15)
Re: SMTP rule needed Andreu . Gomez (Apr 10)
Re: what is good Andreu . Gomez (Apr 22)
Re: snort redhat 7.2 server and mysql Andreu . Gomez (Apr 15)

Andrew Blevins

RE: TCP ******S* portscan Andrew Blevins (Apr 05)
RE: TCP ******S* portscan Andrew Blevins (Apr 05)
Classtype Field for Win32 Rules Andrew Blevins (Apr 01)
RE: what does this mean Andrew Blevins (Apr 05)
RE: Question about Demarc Andrew Blevins (Apr 19)

Andrew R. Baker

Re: barnyard problem dotted quad backwards or corrupted? Andrew R. Baker (Apr 14)
Re: barnyard-0.1.0-beta5 and mysql Andrew R. Baker (May 27)
Re: will barnyard output full detail for alert? Andrew R. Baker (Apr 14)
Re: barnyard ignores msg text on custom rules? Andrew R. Baker (Apr 28)
Re: missing declaration makes 1.8.6 to segfault Andrew R. Baker (Apr 14)
Re: Which version should I use? 1.8.3 .4 .5 or .6 Andrew R. Baker (Apr 16)
Re: Signature names Andrew R. Baker (Apr 23)
Re: port lists for 1.8 Andrew R. Baker (Jun 27)
Barnyard 0.1.0 beta5 released Andrew R. Baker (May 27)
Barnyard 0.1.0 RC1 available Andrew R. Baker (Jun 27)
Barnyard 0.1.0 beta6 released Andrew R. Baker (May 27)
Re: barnyard over TCP Andrew R. Baker (May 31)

Andrew Walther

having trouble with idmef support Andrew Walther (Apr 15)

Andrew . Zielinski

Re: Snort in a switched environment Andrew . Zielinski (May 14)
Re: Automating Snort on W2k using WinAt Andrew . Zielinski (May 02)

Andy McLeod

RE: Curse of the cmd.exe Andy McLeod (Jun 17)
RE: Count option WAS smtp rcpt to overflow Andy McLeod (Jun 17)

Anthony Liberty

RE: acid on RH7.2 Anthony Liberty (Apr 12)
writing snort rules ? <newbies> Anthony Liberty (Apr 22)

Anthony Scott

Should I worry?? Anthony Scott (Jun 25)
newbie - excluding an IP Address Anthony Scott (Jun 13)

Anton A. Chuvakin

Re: Snort+flexresp Anton A. Chuvakin (Apr 02)
ACID bug with archiving Anton A. Chuvakin (Apr 25)
Re: Help with tcpdump log rotation Anton A. Chuvakin (May 09)
Re: Snort, MySQL, Acid Anton A. Chuvakin (May 06)

Anton Chuvakin

ruletype directive doesn't work: why? Anton Chuvakin (May 07)

arlenf

Snort & Acid on OpenBSD 3.1? arlenf (Jun 05)
Re: Snort & Acid on OpenBSD 3.1? arlenf (Jun 06)

Ashley Thomas

EXTERNAL_NET Ashley Thomas (Jun 22)
mismatch. Ashley Thomas (Jun 28)
Snort defining WORDS_BIGENDIAN Ashley Thomas (Apr 17)
Packet payload Ashley Thomas (Jun 08)
Re: Another question Ashley Thomas (May 11)
String matching in snort. Ashley Thomas (May 12)
Re: Cisco PIX firwalls.. Ashley Thomas (Apr 12)
RE: Snort performance (was Re: Help with where to place ...) Ashley Thomas (Jun 24)
OT: decoding a packet to port 1433 Ashley Thomas (Jun 27)
regarding Snort design. Ashley Thomas (Apr 22)
RE: EXTERNAL_NET Ashley Thomas (Jun 23)
Order of preprocessing... Ashley Thomas (Jun 03)
Dynamic rule activation/deactivation. Ashley Thomas (Apr 23)
RE: matching logs.. Ashley Thomas (Jun 06)
Snort getting overloaded by http traffic: Ashley Thomas (Jun 25)
overlapping fragments Ashley Thomas (May 21)
RE: EXTERNAL_NET = any - HOME_NET Ashley Thomas (Jun 26)
Dynamically loading/unloading pre-processors... Ashley Thomas (May 10)
portscan ? Ashley Thomas (Jun 08)
snort configuration using gui... Ashley Thomas (May 19)
Regarding latest snort rules. Ashley Thomas (May 24)
Setting specific filters on Snort. Ashley Thomas (Apr 04)
matching logs.. Ashley Thomas (Jun 06)
RE: Snort getting overloaded by http traffic: Ashley Thomas (Jun 25)
RE: bpf filter Ashley Thomas (Jun 03)

Austin Gonyou

RE: Cisco PIX firwalls.. Austin Gonyou (Apr 15)
Cisco PIX firwalls.. Austin Gonyou (Apr 12)

Bamm Visscher

Re: Same question again.. Bamm Visscher (May 25)

Banai Zoltan

log ftp servers in our network Banai Zoltan (Apr 14)

Bastian Ballmann

Snort in a switched environment Bastian Ballmann (May 14)
Signature for Snort 1.8.x Bastian Ballmann (May 13)

Baxter, John

Compile errors in Snort 1.8.6 with flexresp Baxter, John (May 07)
RE: Compile errors in Snort 1.8.6 with flexresp Baxter, John (May 07)

Ben

Re: How to create the DB indices with postgresql Ben (Jun 27)

Bennett Todd

Re: Stoopid port syntax question Bennett Todd (Jun 27)
Snort performance (was Re: Help with where to place ...) Bennett Todd (Jun 24)

Beno Chapman

Re: 3 Snort, 1 MySQL Beno Chapman (Jun 28)
Re: BO pre-processor Beno Chapman (Jun 18)

Benoit Clarembeau

Snort and the Windows Family... Benoit Clarembeau (Apr 05)
Re: Snort and the Windows Family... Benoit Clarembeau (Apr 05)

Ben Whittaker

Mandrake setup Ben Whittaker (Jun 11)

bfindley

CONFIGURING SNORT TO USE MYSQL bfindley (May 03)

Bill McCarty

ASCII logging Bill McCarty (Jun 24)
Re: Anomalous packet logged by Snort (fwd) Bill McCarty (Apr 10)
Re: DOS MSDTC attempt false positive Bill McCarty (May 10)
Anomalous packet logged by Snort Bill McCarty (Apr 07)
Re: Anomalous packet logged by Snort Bill McCarty (Apr 07)
Re: DOS MSDTC attempt false positive Bill McCarty (May 11)

Blake Fithen

RE: Syslog on W2K Blake Fithen (Jun 12)

Bob Hillegas

HOME_NET question... Bob Hillegas (Apr 22)
modprobe error in log... Bob Hillegas (May 10)
Re: modprobe error in log... Bob Hillegas (May 13)
Re: HOME_NET question... Bob Hillegas (Apr 23)

Bob Walder

RE: Re: Off topic: Thousands of traceroutes ? Bob Walder (May 14)
RE: snortconf via web Bob Walder (May 04)

Bradley, Paul

RE: Problem emailing alerts from ACID Bradley, Paul (Jun 17)
Problem emailing alerts from ACID Bradley, Paul (Jun 17)
FrontPage Events Bradley, Paul (Apr 03)
RE: Problem emailing alerts from ACID Bradley, Paul (Jun 18)

Brad Lisoweski

RE: ACID help Brad Lisoweski (May 23)
Alerts with Snort Brad Lisoweski (May 21)

Brad Merluzzi

Outgoing FTP Rule? Brad Merluzzi (Jun 17)

Brad Powell

Re: fragroute vs. snort: the tempest in a teacup Brad Powell (Apr 19)

Bravard, Paul

Dies Bravard, Paul (Jun 12)

Brenda A. Bell

RE: flags Brenda A. Bell (Jun 11)

Brian

Re: Unable to start snort version 1.8.6 in Daemon mode Brian (Apr 10)
Re: Best Way To Handle New Rules Brian (Apr 16)
Re: Duplicate sid:257; ???? Brian (Apr 16)
Re: How to ignore scan from a host Brian (Apr 16)

Brian (Automail)

SNORT FAQ Brian (Automail) (May 11)
SNORT FAQ Brian (Automail) (Jun 01)
SNORT USAGE Brian (Automail) (May 11)
SNORT USAGE Brian (Automail) (Jun 29)
SNORT FAQ Brian (Automail) (Apr 06)
SNORT FAQ Brian (Automail) (May 18)
SNORT FAQ Brian (Automail) (Jun 22)
SNORT USAGE Brian (Automail) (May 18)
SNORT USAGE Brian (Automail) (Jun 08)
SNORT FAQ Brian (Automail) (May 25)
SNORT FAQ Brian (Automail) (Jun 29)
SNORT FAQ Brian (Automail) (Apr 13)
SNORT FAQ Brian (Automail) (Jun 15)
SNORT USAGE Brian (Automail) (May 04)
SNORT USAGE Brian (Automail) (Jun 15)
SNORT USAGE Brian (Automail) (Apr 13)
SNORT USAGE Brian (Automail) (Apr 06)
SNORT USAGE Brian (Automail) (May 25)
SNORT USAGE Brian (Automail) (Jun 22)
SNORT USAGE Brian (Automail) (Jun 01)
SNORT FAQ Brian (Automail) (Jun 08)
SNORT FAQ Brian (Automail) (May 04)

Brian Ertel

IRC - BOT networks: RULES ? Brian Ertel (May 07)
Automating Snort on W2k using WinAt Brian Ertel (May 02)
W2k - WinAt - Stopping Snort Brian Ertel (May 02)

Brian Hughes

Re: Problem getting Snort to Connect to PostgreSQLdatabase Brian Hughes (May 15)
Problem getting Snort to Connect to PostgreSQL database Brian Hughes (May 15)
Problem getting Snort to Connect to PostgreSQL database Brian Hughes (May 14)

Brian Van Benschoten

ACID slow to bring up packet details - running on W2K with MS-SQL 2000 SP2 Brian Van Benschoten (May 11)

Brown, Bobby (US - Hermitage)

RE: Automating Snort on W2k using WinAt Brown, Bobby (US - Hermitage) (May 03)

Bruno Taranto

Re: Snort in a switched environment Bruno Taranto (May 15)
Re: Snort in a switched environment Bruno Taranto (May 15)
switch? for what? Bruno Taranto (May 15)
Re: Fw: LOG DE ERRO bruno taranto (Apr 18)
Re: Problem getting Snort to Connect to PostgreSQL database Bruno Taranto (May 15)
Re: CONFIGURING SNORT TO USE MYSQL Bruno Taranto (May 03)

Bryce Stenberg

Rules problem on dual nic vpn server... Bryce Stenberg (Jun 23)

BShinn

RE: Snort packet stats BShinn (May 16)
RE: Offtopic - Snort packet stats BShinn (May 16)

bthaler

Re: ERROR LOG bthaler (Apr 18)
RE: Alerts with Snort bthaler (May 21)
Re: Problem enabling flexresp bthaler (Apr 17)
Offtopic - Snort packet stats bthaler (May 16)
RE: Constantly displaying the event on the console bthaler (May 30)
RE: SSL CodeRed et al bthaler (May 28)
RE: shellcode error bthaler (May 30)
RE: SSL CodeRed et al bthaler (May 28)
RE: Barnyard? bthaler (May 31)
Re: Problem enabling flexresp bthaler (Apr 17)
SSL CodeRed et al bthaler (May 28)
Problem enabling flexresp bthaler (Apr 17)

Buchanan, Randy

Source Port 0 traffic Buchanan, Randy (Apr 12)

Byerly, Ted

Snort w/SnortSnarf index.html not showings stats Byerly, Ted (Apr 15)

Byron

Re: Installing Snort on Win 2K Byron (Jun 17)

Carles Xavier Munyoz Baldó

SNORT GUI Carles Xavier Munyoz Baldó (Jun 27)
alert by email. Carles Xavier Munyoz Baldó (May 23)

Carlos Augusto Silva

LogCheck Carlos Augusto Silva (Apr 22)
OFF-TROPIC - Boot Disk Carlos Augusto Silva (May 13)
Snort error on kernel Carlos Augusto Silva (Apr 09)
ERROR LOG Carlos Augusto Silva (Apr 18)
Re: Help-me Carlos Augusto Silva (Apr 09)
Re: Help-me Carlos Augusto Silva (Apr 09)
Snort sendme email Carlos Augusto Silva (Apr 18)
Segmentation fault (core dumped) Carlos Augusto Silva (Apr 15)
Help-me Carlos Augusto Silva (Apr 09)
Snort syslog em outro arquivo Carlos Augusto Silva (Apr 19)
Snort error on kernel - please helpme Carlos Augusto Silva (Apr 10)
Re: Syslog output other file Carlos Augusto Silva (Apr 19)
Snort ERROR on Kernel Carlos Augusto Silva (Apr 09)
Syslog output other file Carlos Augusto Silva (Apr 19)
Fw: LOG DE ERRO Carlos Augusto Silva (Apr 18)

Carlos Kumbak

Multiple Content (not working?) Carlos Kumbak (May 15)
Re: Multiple Content (not working?) Carlos Kumbak (May 16)

Cavey, Mark A.

RE: Snort comparisons Cavey, Mark A. (May 20)

C Boss

Same question again.. C Boss (May 25)
Re: Same question again.. C Boss (May 29)
Snort with -b option and alerts to syslog.. C Boss (May 22)
(no subject) C Boss (Apr 25)

cbumpste

Acid Graphing cbumpste (May 06)

c cheng

can't start snort c cheng (Apr 10)
Re: can't start snort c cheng (Apr 10)

Cearns Angela

Re: not detecting common intrusion Cearns Angela (Jun 26)
RE: not detecting common intrusion Cearns Angela (Jun 27)
Re: not detecting common intrusion Cearns Angela (Jun 26)
RE: not detecting common intrusion Cearns Angela (Jun 27)
not detecting common intrusion Cearns Angela (Jun 26)
snort-mysql installation - not logging Cearns Angela (Jun 25)

Cedric Guillotin

Re: snort configuration using gui... Cedric Guillotin (May 21)

ChandlerH

RE: barnyard over TCP ChandlerH (May 30)
FW: (no subject) ChandlerH (Jun 04)

Chang, Andre

Constantly displaying the event on the console Chang, Andre (May 30)
excluding a host from rule Chang, Andre (May 30)

Chavez Chris Contr 411 FLTS/TSF

RE: Setting up a Windowz Interface to monitor with no IP Address Chavez Chris Contr 411 FLTS/TSF (Jun 28)

Chewie

Demarc Chewie (May 01)
MySQL Chewie (Apr 27)
Newbie question Chewie (Apr 20)
Sensors and Home Net Chewie (Apr 27)
Hogwash Chewie (Apr 27)
RE: MySQL Chewie (Apr 27)

Chris Adams

Re: maxsize of mysql db? Chris Adams (Apr 14)
Re: Should I worry?? Chris Adams (Jun 25)

Chris Connelly

multiple HTTP_PORTS Chris Connelly (Jun 20)

Chris Eidem

RE: Thoughts on internal vs. external IDS rulesets Chris Eidem (Apr 10)
test message -- ignore Chris Eidem (Apr 05)
(no subject) Chris Eidem (Apr 14)
Thoughts on internal vs. external IDS rulesets Chris Eidem (Apr 10)
RE: (no subject) Chris Eidem (Apr 15)
RE: what's the best setup? Chris Eidem (Jun 17)

Chris Frazier - PA

RE: Snort Solaris 8 with quad card Chris Frazier - PA (Apr 03)
Snort Solaris 8 with quad card Chris Frazier - PA (Apr 02)

Chris Green

Re: Rules under SNORT_1_8 cvs tag? Chris Green (Apr 02)
Re: No alerts Chris Green (Mar 31)
Re: Best Way To Handle New Rules Chris Green (Apr 12)
Re: Ignore multiple hosts with command line arguments Chris Green (Jun 03)
Re: Snot based attacks and the -z est option. Chris Green (Apr 26)
Re: Anomalous packet logged by Snort Chris Green (Apr 08)
New options coming out in 1.8.7beta1 Chris Green (Apr 24)
Re: RV: Snort exploits Chris Green (Apr 17)
Re: snort problem on HP-UX 11.00 and TokenRing Chris Green (May 02)
Re: icmp: is this real? Chris Green (Apr 01)
Re: Snort Log Despoofer Chris Green (May 16)
Re: [Snort-devel] fragroute related fixes need testing on real networks Chris Green (Apr 22)
Re: Compilation Error Chris Green (Jun 10)
Re: Playing wavs or mp3 on intrusion detect Chris Green (May 13)
Re: include problem in 1.8.6 Chris Green (Apr 10)
Re: Stoopid port syntax question Chris Green (Jun 27)
Re: "Flow" problem Chris Green (Apr 28)
Re: snort 1.8.6 and AIX 4.3.3 Chris Green (Jun 19)
Re: Anomalous packet logged by Snort Chris Green (Apr 08)
Re: Tap -> Hub Problem. Chris Green (May 06)
Re: OT: Deciphering log entry(iptables) Chris Green (Apr 02)
Re: Is this a valid traffic? Chris Green (Apr 03)
Re: Compile errors in Snort 1.8.6 with flexresp Chris Green (May 07)
Re: rule processing. Chris Green (Apr 02)
Re: missing declaration makes 1.8.6 to segfault Chris Green (Apr 09)
Re: Help-me Chris Green (Apr 09)
Re: Snort dying unexpectedly Chris Green (Apr 25)
Re: fragrouter missed beginning Chris Green (Apr 24)
Re: Snort and network taps Chris Green (Apr 23)
Re: Snot attacks and -z est option - regarding FAQ 1.9 Chris Green (Apr 02)
Re: Snort signatures Chris Green (Apr 26)
Re: snort 1.8.7 and fragroute Chris Green (Jun 05)
Re: Detecting tunnels? Chris Green (May 03)
Re: tcpdump and snort report 2 different TTL values Chris Green (Apr 02)
Re: Snort not loggin Chris Green (Jun 24)
Disabling state alerts separately from evasion alerts Chris Green (Apr 25)
Re: ./configure --with-mysql= ? Chris Green (Apr 02)
Re: Snort on HP-UX Chris Green (Apr 10)
Re: spp_stream4 alerts "un-disable-able" ? :-) Chris Green (May 23)
Re: Anomalous packet logged by Snort Chris Green (Apr 08)
Re: Other Snort rulesets? Chris Green (Apr 09)
Re: [Snort-devel] fragroute related fixes need testing on real networks Chris Green (Apr 23)
Re: Snot based attacks and the -z est option. Chris Green (Apr 26)
HP-UX /Sparc/ Linux/weirdplatform users Chris Green (Apr 25)
NOVA snort user's group meeting Chris Green (Jun 05)
Re: cannot compile snort on Freebsd 4.5 or 4.6 from cvs.....snort 1.8.6 compiles ok Chris Green (May 28)
Re: 1.8.6 RPMS?? Chris Green (May 30)
Re: Snort exploits Chris Green (Apr 24)
Re: stream4 oddity Chris Green (Apr 24)
Re: daemon consuming 100% memory Chris Green (May 13)
Re: 1.8.5 ? Chris Green (Apr 03)
Re: False positives with SMTP RCPT TO overflow rule Chris Green (Jun 27)
Re: 1.8.5 ? Chris Green (Apr 03)
Re: Snort on HP-UX Chris Green (Apr 09)
Re: session log Chris Green (Apr 08)
Re: hp compile question Chris Green (Apr 18)
fragroute related fixes need testing on real networks Chris Green (Apr 22)
Re: [Snort-devel] Order of preprocessing... Chris Green (Jun 03)
Re: BUG in stream4 reassemble Chris Green (Apr 01)
Re: Snort dying unexpectedly Chris Green (Apr 25)
Re: Tagging and Packet Payload Chris Green (Jun 03)
Re: Snort on HP-UX Chris Green (Apr 11)
Re: Re: Snort-users digest, Vol 1 #1861 - 13 msgs Chris Green (May 08)
Re: [Snort-devel] missing includes in large number of files Chris Green (Apr 04)
Re: flexresp on 1.8.6 with red hat 7.2 Chris Green (May 30)
Re: BUG in stream4 reassemble Chris Green (Apr 02)
Re: port lists for 1.8 Chris Green (Jun 26)
Re: Stoopid port syntax question Chris Green (Jun 27)
Re: use of BPF in 1.8.7beta6 might be broken Chris Green (Jun 11)
Re: Setting specific filters on Snort. Chris Green (Apr 04)
Re: FYI - Possible cause for false positive - ICMP L3retriever Ping Chris Green (Jun 13)
Re: Error if I start snort Chris Green (Apr 15)
Re: Windows Warning Chris Green (Apr 02)
Re: Some questions about snort Chris Green (Apr 05)
Re: make error in snort-current spo_SnmpTrap.@OBJEXT@ Chris Green (Apr 19)
Re: Who Do I contact about posting something on the Snort.org website? Chris Green (May 02)
Re: snort current doesnt run Chris Green (Apr 03)
Re: VAR and IP lists Chris Green (Apr 02)
Re: Core dumping with more then 1 rule enabled Chris Green (Jun 08)
Re: Snort dying unexpectedly Chris Green (Apr 25)
Re: snort 1.9.x would not compile on FreeBSD 4.5 Chris Green (Jun 04)
Re: snort does not log data Chris Green (Apr 01)
Re: snort-current rules syntax error Chris Green (Apr 16)
Re: Tying alerts to hostnames? Chris Green (Jun 17)
Re: Snort 1.8.6 RPMS? Chris Green (Apr 09)
Re: Todays checkout fails miserably... Chris Green (Apr 08)
OT: Sourceforge (Was: Re: flexresp on 1.8.6 with red hat 7.2) Chris Green (May 31)
Re: Core dumping with more then 1 rule enabled Chris Green (Jun 08)
Re: Detecting concurrent connections Chris Green (Jun 12)
Re: Dynamic rule activation/deactivation. Chris Green (Apr 23)
Re: Snot based attacks and the -z est option. Chris Green (Apr 26)
Re: icmp: is this real? Chris Green (Mar 31)
Re: snort 1.8.6 crashing when running two instances on the same interface with Openbsd Chris Green (Apr 15)
Re: 1.8.6 problem: Misdetection and hangup Chris Green (Jun 04)
Snort 1.8.6 is Available! Chris Green (Apr 08)
Re: Would you suspect? Chris Green (Apr 11)
Re: stream4 oddity --- Update Chris Green (Apr 24)

Chris Keladis

Re: Curse of the cmd.exe Chris Keladis (Jun 14)
Re: TCP ******S* portscan Chris Keladis (Apr 05)
portscsan.log summary. Chris Keladis (May 31)
Re: configure snort to drop payloads Chris Keladis (Apr 18)

Chris Reid

Re: Stubbourn Pcap Error Chris Reid (May 27)
Re: Snort database relationship info? Chris Reid (Apr 11)
Re: More WinPcap 2.3 and Win2k Chris Reid (Jun 18)
Re: winpcap Chris Reid (Apr 27)
Re: Win32 Port of Snort Chris Reid (May 20)
Re: FW: ERROR: OpenPcap Chris Reid (Jun 19)
Re: XP / Snort / Error opening device Chris Reid (Jun 30)
Re: Compiling snort on Win32 Chris Reid (May 31)
Re: Buffer too small for packet.dll? (was: Error initializing NIC) Chris Reid (Apr 25)
Re: Automating Snort on W2k using WinAt Chris Reid (May 02)
Re: Compiling snort on Win32 Chris Reid (Jun 01)

Christian Kuhtz

RE: snort performance Christian Kuhtz (Apr 16)
RE: RE: snort performance Christian Kuhtz (Apr 17)
snort performance Christian Kuhtz (Apr 16)
Re: mysql 100% cpu utliization Christian Kuhtz (Apr 18)

Christian Nesmark

Win2k and dial-up connection Christian Nesmark (Apr 17)

Christophe Sahut

RE : snortconf via web Christophe Sahut (May 02)
RE : port 22 scan Christophe Sahut (Jun 04)

Chr. v. Stuckrad

Re: bad priority messages Chr. v. Stuckrad (Apr 10)
Snort-1.8.6 on SuSE-7.2 selfmade pcap-0.7.1 dies in 'content list' ?! Chr. v. Stuckrad (Apr 10)

C. Jason Coit

Re: String matching in snort. C. Jason Coit (May 18)

CJATeck

Re: Setting up a Windowz Interface to monitor with no IP Address CJATeck (Jun 28)
Re: Stubbourn Pcap Error CJATeck (May 27)
Re: Setting up a Windowz Interface to monitor with no IP Address CJATeck (Jun 28)
Re: Best real-time alerting tool CJATeck (Jun 05)
Re: Setting up a Windowz Interface to monitor with no IP Address CJATeck (Jun 28)
Re: Pretty Reports for Management CJATeck (May 31)

C.J.O.

Snort 1.8.6 and PPPoE links C.J.O. (Jun 20)

Claude Bailey

RE: RE: BO pre-processor Claude Bailey (Jun 18)

Clay Caviness

mysql Duplicate entry Clay Caviness (May 13)
snort, mysql Duplicate entry Clay Caviness (May 09)

___cliff rayman___

Re: acid-archive-snortprob ___cliff rayman___ (Apr 04)
Re: 1.8.5 mysql_error ___cliff rayman___ (Apr 03)
Re: 1.8.5 mysql_error ___cliff rayman___ (Apr 04)
Re: configure --with-mysql= ? ___cliff rayman___ (Apr 02)

Cloppert, Michael

Problem graphing in ACID w/Snort Cloppert, Michael (May 15)
FreeBSD, Apache, and ACID Cloppert, Michael (Jun 26)

Concordio M. Pajayat, Jr.

NIDS newbie question Concordio M. Pajayat, Jr. (May 12)

Cooper Arthur B Contr WCOM

Bandwidth Information Cooper Arthur B Contr WCOM (May 29)
Getting MYSQL support compiled Cooper Arthur B Contr WCOM (May 21)

COULOMBE, TROY

RE: [Snorting 2 NICs] COULOMBE, TROY (Jun 11)
Preprocessors COULOMBE, TROY (Jun 03)
RE: Setting the nic up ?? COULOMBE, TROY (Jun 10)

counterping

Snort IGNORES var HOME_NET counterping (May 03)

counter . spy

double post of Re: Snot attacks... counter . spy (Apr 01)
Re: Snot attacks and -z est option - regarding FAQ 1.9 counter . spy (Apr 01)
RE: switch counter . spy (May 15)
RE: not really off topic counter . spy (Apr 11)
snort 186 does not detect/log any portscans counter . spy (Apr 24)
RE: RV: Snort exploits counter . spy (Apr 17)
Re: SQLsnake - any able to create a sig for this one? counter . spy (May 22)
RE: Snot based attacks and the -z est option. counter . spy (Apr 25)
Re: testing snort counter . spy (Jun 16)
Re: Cisco PIX firwalls.. counter . spy (Apr 15)
RE: RV: Snort exploits counter . spy (Apr 17)
RE: Filesize limit exceeded counter . spy (May 01)
RE: Snort, Stream4 State and Ethernet Taps. counter . spy (May 01)
RE:ACID Problem counter . spy (May 16)
Re: snort 186 does not detect/log any portscans counter . spy (Apr 25)
Snort & Prelude counter . spy (May 31)
Re: Flexresp counter . spy (Apr 08)
RE: Advice on the Network Infrastructure Side of IDS Design... counter . spy (Apr 25)
Re: Future features??? counter . spy (May 12)
Re: Snot attacks and -z est option - regarding FAQ 1.9 counter . spy (Apr 01)
NIDS in switched environments counter . spy (May 18)
Snort and network taps counter . spy (Apr 23)
Re: Snot based attacks and the -z est option. counter . spy (Apr 26)
RE: Snort, Stream4 State and Ethernet Taps. counter . spy (May 01)
RE: Snort in a switched environment counter . spy (May 14)
RE: Snort loading at startup counter . spy (May 14)

Craig, Scott

RE: fragroute vs. snort: the tempest in a teacup Craig, Scott (Apr 25)

Crist J. Clark

Re: fragroute vs. snort: the tempest in a teacup Crist J. Clark (Apr 20)

c white

what's the best setup? c white (Jun 17)
snort with mysql and acid C White (Jun 12)
snort, mysql, acid C White (Jun 13)

cwhite

error initializing the network interface on win2k cwhite (Jun 13)

D'Amato Luigi

Snort not Log D'Amato Luigi (May 13)
cavo stealth D'Amato Luigi (May 20)
Re: Snort not Log D'Amato Luigi (May 14)

Damien Hart

RE: snort with mysql and acid Damien Hart (Jun 13)

Dan D.

What do these errors mean? Dan D. (May 14)

Dan Fiorito

HP Printing Dan Fiorito (May 08)
FW: snortdb schema update Dan Fiorito (Apr 02)

Dan Hawrylkiw

Re: Anomalous packet logged by Snort Dan Hawrylkiw (Apr 14)

Daniel Curry

Re: Libpcap library/headers not found and bigendian? Daniel Curry (Apr 15)
Re: Libpcap library/headers not found and bigendian? Daniel Curry (Apr 15)
verification test? Daniel Curry (Jun 27)
Re: Snort DB configuration Daniel Curry (May 02)
Re: Libpcap library/headers not found and bigendian? Daniel Curry (Apr 15)
Libpcap library/headers not found and bigendian ? Daniel Curry (Apr 14)
Libpcap library/headers not found and bigendian ? Daniel Curry (Apr 10)
undefined reference to `dlopen' Daniel Curry (Jun 24)

Daniel J Camero

Snort Rule Id (sid) Daniel J Camero (Apr 06)

Daniel Lang

How to create the DB indices with postgresql Daniel Lang (Jun 27)
Re: How to create the DB indices with postgresql Daniel Lang (Jun 27)
Re: How to create the DB indices with postgresql Daniel Lang (Jun 28)

Daniel Lopez

Help with where to place a Snort sensor! -newbie questions- Daniel Lopez (Jun 19)
Snort architecture- How Detection Engine works? Daniel Lopez (Jun 30)

dareen

ADdRules dareen (May 12)

Darren Reed

Re: fragroute vs. snort: the tempest in a teacup Darren Reed (Apr 18)

Darren Young

Automating Sensor Installation Darren Young (May 19)
Demarc Plugins Darren Young (Jun 10)
Alerts Darren Young (Jun 08)
Exclude Source? Darren Young (Jun 09)
DSL Monitoring Darren Young (May 05)
Testing Snort Darren Young (May 20)

Darrin Powell

Description of snort plugins Darrin Powell (Jun 07)

DataShark

Re: Snort not loggin hack attempts DataShark (Jun 25)

Dave Packham

HTTP-Proxy scan attempts Dave Packham (Jun 25)

David Alexandre M. de Carvalho

Preventing Attacks David Alexandre M. de Carvalho (Jun 25)

David Bianco

p2p bird-dog rules David Bianco (Apr 24)
Spurious Alerts? David Bianco (Apr 30)
looks false-positive David Bianco (Apr 11)
Anyone recognize this packet? David Bianco (Apr 03)

David Chait

RE: Why only detecting host-based attacks? David Chait (Jun 26)

David E. Wach

RE: Can you simply merge separate Snort SQL databases? David E. Wach (May 01)
RE: Can you simply merge separate Snort SQL databases? David E. Wach (May 02)

Dell, Jeffrey

RE: snortconf via web Dell, Jeffrey (May 03)
RE: Portscan.log utility Dell, Jeffrey (May 01)

Demetri Mouratis

Re: Odd question... Demetri Mouratis (May 01)
Re: Automating Sensor Installation Demetri Mouratis (May 19)
Snort/ACID PostgreSQL DB error Demetri Mouratis (Apr 14)
ACID Database Error Demetri Mouratis (Apr 14)

Denis Romanov

Re: Snort-users digest, Vol 1 #1760 - 15 msgs Denis Romanov (Apr 05)
no UDP Denis Romanov (Apr 04)
Re: Snort-users digest, Vol 1 #1762 - 13 msgs Denis Romanov (Apr 05)

Detmar Liesen

RE: re: 1. Network World IDS report (Jason Haar) Detmar Liesen (Jun 27)
RE: Setting up a Windowz Interface to monitor with no IP Address Detmar Liesen (Jun 28)

Devon Harding - GTHLA

snort not logging to database Devon Harding - GTHLA (May 22)
snortrules.tar.gz Devon Harding - GTHLA (May 15)
RE: archive snort logs? Devon Harding - GTHLA (Apr 04)
RE: snort not logging to database Devon Harding - GTHLA (May 22)
RE: demarc: validate Devon Harding - GTHLA (May 15)
archive snort logs? Devon Harding - GTHLA (Apr 03)
snort not logging to database Devon Harding - GTHLA (May 22)
demarc: validate Devon Harding - GTHLA (May 15)

DICEJ

spp_portscan msg DICEJ (Jun 11)

Dino Macedo Amaral

I can't logging data : My snort.conf Dino Macedo Amaral (Apr 09)

diwelf

Snort + Demarc Remote logging? diwelf (May 13)

Djinn D'Angel

Snort and ACID on separate systems? Djinn D'Angel (Jun 18)

dlpassport

Problems logging to syslog and mysql simultaneously dlpassport (Jun 19)
RE: Problems logging to syslog and mysql simultaneously dlpassport (Jun 20)
RE: Problems logging to syslog and mysql simultaneously dlpassport (Jun 19)

Dmitry Glushenok

acidlab: restoring snort_archive to snort_log Dmitry Glushenok (Jun 12)

DoL

Re: select rules DoL (Jun 13)
select rules DoL (Jun 13)
Testing tools DoL (Jun 15)
Re: use of tables DoL (Jun 12)
use of tables DoL (Jun 11)

Don

RE: Problems logging to syslog and mysqlsimultaneously Don (Jun 22)
RE: Compiling snort on Win32 Don (May 31)
RE: I need some serious help Don (Jun 11)
RE: More WinPcap 2.3 and Win2k Don (Jun 19)
RE: error initializing the network interface on win2k Don (Jun 13)
RE: Email alert and porscan.log on a daily basis Don (Jun 01)
RE: More WinPcap 2.3 and Win2k Don (Jun 19)
icmp i want to ignore Don (Jun 05)
Snort and SysLogging, warning Don (Jun 20)
RE: external_net and home_net questions Don (Jun 02)
RE: Problems logging to syslog and mysql simultaneously Don (Jun 26)
RE: Syslog on W2K Don (Jun 13)
RE: excluding a host from rule Don (May 31)
RE: syslog Don (Jun 06)
RE: Exploit? Don (Jun 13)
RE: Syslog on W2K Don (Jun 12)
RE: Problems logging to syslog and mysql simultaneously Don (Jun 19)
RE: Best real-time alerting tool Don (Jun 04)
RE: Snort ---> syslog Don (Jun 21)
RE: EXTERNAL_NET Don (Jun 23)
SQL login attempts Don (Jun 07)
I need some serious help Don (Jun 11)
syslog Don (Jun 06)

Don McEachern

RE: switch Don McEachern (May 15)

Donna MacLeod

Pretty Reports for Management Donna MacLeod (May 31)

doug.fee () unisys com

Snort Books doug.fee () unisys com (May 13)

Douglas

Tap traffic reassembly using OpenBSD bridge? Douglas (May 26)

Dragos Ruiu

Re: Classtype Field for Win32 Rules Dragos Ruiu (Apr 14)
fragroute vs. snort: the tempest in a teacup Dragos Ruiu (Apr 17)
Re: SHELLCODE x86 unicode NOOP Dragos Ruiu (Apr 22)
Re: Subliminal html in spam? Dragos Ruiu (Apr 04)
Re: Snort on WinXP: driver problem Dragos Ruiu (Apr 02)
Fw: Re: Snort exploits Dragos Ruiu (Apr 17)

dr.kaos

Re: AW: Price for "vanilla Snort" (no bells and whistle s) dr.kaos (May 07)
Re: Price for "vanilla Snort" (no bells and whistles) dr.kaos (May 06)
Re: Price for "vanilla Snort" (no bells and whistles) dr.kaos (May 08)
Re: Remote Syslog dr.kaos (May 09)

Dr. Richard W. Tibbs

Re: Unix sockets Dr. Richard W. Tibbs (Jun 03)
Re: Re: configure snort to drop payloads Dr. Richard W. Tibbs (Apr 18)
Re: configure snort to drop payloads Dr. Richard W. Tibbs (Apr 18)

DThomaz

List of IP Address DThomaz (Jun 26)
HELP Port 1080 only DThomaz (Jun 20)
Snort Topology Configuration DThomaz (Jun 24)

Dug Song

Re: fragroute vs. snort: the tempest in a teacup Dug Song (Apr 18)

D W

Re: Setting the nic up ?? D W (Jun 10)
Re: Current Rule Set D W (Jun 10)
Auditing Snort Rules (Signatures) D W (Jun 10)

dweise

snort + mysql dweise (May 30)

Eagle_2-7

non privileged portscans Eagle_2-7 (Apr 17)

East, Bill

RE: SSL CodeRed et al East, Bill (May 28)

ed

Re: Portscan not logging ed (May 28)
Re: snortconf via web ed (May 05)
Re: Shellcode.rules fatal error? ed (May 12)

Ed Chen

PureSecure 1.6 Ed Chen (May 15)

Edin Dizdarevic

Re: Snort in a switched environment (Ignore this (Sorry, I have to make this test)) Edin Dizdarevic (May 15)
Re: switch Edin Dizdarevic (May 15)
Only testing... Edin Dizdarevic (May 14)

Ed Kasky

Excluding $HOME_NET -> $HOME_NET Alerts Ed Kasky (May 19)
Re: Snort and Logwatch Ed Kasky (Apr 08)
Shellcode.rules fatal error? Ed Kasky (May 12)
Re: Excluding $HOME_NET -> $HOME_NET Alerts Ed Kasky (May 19)
Re: Excluding $HOME_NET -> $HOME_NET Alerts Ed Kasky (May 20)
Viewing MySql Archive with Acid Ed Kasky (May 15)
Portscan not logging Ed Kasky (May 27)
Re: Portscan not logging Ed Kasky (May 28)

Ed McMan

Re: [despammed] RE: Looking for tool to generate isp/domain notific ation emails.... Ed McMan (May 10)
Strange logging problem Ed McMan (Jun 02)
Re: [despammed] RE: Re: Off topic: Thousands of traceroutes ? Ed McMan (May 13)
winpcap Ed McMan (Apr 27)
Re: [despammed] Re: Future features??? Ed McMan (May 12)
Re: [despammed] Dr. Watson when Logging in Binary Mode Ed McMan (Jun 11)
Re: [despammed] Snort > mysql > acid - timestamp troubles Ed McMan (May 30)
Re: [despammed] DSL Monitoring Ed McMan (May 05)
Re: [despammed] RE: Offtopic - Snort packet stats Ed McMan (May 16)

Ed Quackenbush

Empty alert records in unified spool for portscan and bo preproce ssors... Ed Quackenbush (Jun 13)
RE: Session data, alerts, and barnyard Ed Quackenbush (Jun 11)
Session data, alerts, and barnyard Ed Quackenbush (Jun 10)

Ed Spick

acid-archive-snortprob Ed Spick (Apr 04)
Re: Alerts Ed Spick (Jun 14)
acid-archive-problem Ed Spick (Apr 14)

Eduard San Anselmo

(no subject) Eduard San Anselmo (Jun 04)

Edwin Eefting

Re: spp_portscan behavior is 1.8.6 Edwin Eefting (May 23)
spp_stream4 alerts "un-disable-able" ? :-) Edwin Eefting (May 23)
Re: smtp rcpt to overflow Edwin Eefting (Jun 05)

Elinus Liga

Re: Current Rule Set Elinus Liga (Jun 12)

Emanuele Salvador

Re: As a newbie, two questions Emanuele Salvador (May 03)
As a newbie, two questions Emanuele Salvador (May 03)

Enno Rey

RE: fragroute vs. snort: the tempest in a teacup Enno Rey (Apr 19)

Erek Adams

Re: WEB-ATTACKS id command attempt Erek Adams (Apr 15)
Semi-OT: GPL and Snort--Was Cost of Vanilla Snort Erek Adams (May 07)
RE: Snort rules touble. Erek Adams (Jun 21)
Rough Draft: Upgrading Snort Erek Adams (May 15)
Re: Snort Solaris 8 with quad card Erek Adams (Apr 02)
Re: help! Erek Adams (Apr 19)
Re: mysql 100% cpu utliization Erek Adams (Apr 18)
Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Erek Adams (May 08)
Re: snort 1.8.6 crashing when running two instances on the same interface with Openbsd Erek Adams (Apr 15)
Re: Libpcap library/headers not found and bigendian ? Erek Adams (Apr 14)
Re: Same question again.. Erek Adams (May 28)
Re: Snort 99% cpu utilization and no process activity Erek Adams (Apr 14)
Re: Detecting benchmarks Erek Adams (May 08)
Re: SV: Snort doesnt detect traffic. Erek Adams (May 30)
Re: Flexresp problem Erek Adams (Apr 15)
Re: SV: SV: Snort doesnt detect traffic. Erek Adams (May 30)
Re: mysql schema & multiple snort versions & sensors Erek Adams (Apr 04)
Re: p2p bird-dog rules Erek Adams (Apr 24)
Re: Same question again.. Erek Adams (May 25)
RE: Syslog Coughs? Erek Adams (Apr 15)
Re: Problem enabling flexresp Erek Adams (Apr 17)
Re: update rules set automatically Erek Adams (Apr 05)
Re: not detecting common intrusion Erek Adams (Jun 26)
Re: sorry...upgrade question again Erek Adams (May 28)
Re: 1.8.5 ? Erek Adams (Apr 04)
Re: Flexresp problem Erek Adams (Apr 21)
Re: shellcode error Erek Adams (May 31)
Re: nmap scans don't appear in portscan.log Erek Adams (Apr 01)
Re: spp_portscan msg Erek Adams (Jun 11)
Re: Addendum: Segfault on SMB Alert Erek Adams (Apr 18)
RE: How do I ignore portscans from everything but HOME_NET? Erek Adams (Apr 10)
Re: Tying alerts to hostnames? Erek Adams (Jun 17)
Re: Detecting benchmarks Erek Adams (May 08)
Re: Demarc Erek Adams (May 02)
Re: Cisco PIX firwalls.. Erek Adams (Apr 13)
Re: SHELLCODE x86 unicode NOOP Erek Adams (Apr 22)
Re: Placement of Snort IDS Erek Adams (Apr 14)
Re: stop that pesky logging Erek Adams (Apr 02)
Re: Snort Working Mechanism Erek Adams (Apr 02)
Re: Libpcap library/headers not found and bigendian? Erek Adams (Apr 15)
Re: SPADE alerts, but doesn't log Erek Adams (Apr 14)
Re: Snort send mail on alert Erek Adams (Jun 18)
Re: 1.8.6 and tcpdump format Erek Adams (May 22)
Re: Help Erek Adams (Jun 11)
Re: Compile problems on solaris 2.6 Erek Adams (Jun 10)
Re: Portscan.log utility Erek Adams (May 01)
Re: Snort doesnt detect traffic. Erek Adams (May 29)
Re: ICMP Destination Unreachable (Port Unreachable) Erek Adams (Apr 14)
Re: matching logs.. Erek Adams (Jun 06)
Re: Packet payload Erek Adams (Jun 08)
Re: Bandwidth Information Erek Adams (May 29)
Re: newbie pass rule question Erek Adams (Jun 18)
Re: acceptable packet drop rate for snort Erek Adams (Apr 14)
Re: snortconf via web Erek Adams (May 02)
Re: [Snorting 2 NICs] Erek Adams (Jun 11)
Re: portscan-ignorehosts question Erek Adams (Jun 05)
Re: Help with tcpdump log rotation Erek Adams (May 10)
Re: regarding Snort design. Erek Adams (Apr 22)
Re: not detecting common intrusion Erek Adams (Jun 27)
Re: -i any ? Erek Adams (May 14)
Re: SYN flood detection Erek Adams (May 10)
Re: Stable Snort Rules fails? Erek Adams (May 31)
Re: IDS and traffic monitor in one Erek Adams (Jun 18)
Ignore Hosts How-To Erek Adams (Jun 07)
Re: Stoopid port syntax question Erek Adams (Jun 26)
Re: (no subject) Erek Adams (Jun 12)
Re: Detecting benchmarks Erek Adams (May 10)
Re: tcpdump format Erek Adams (Apr 14)
Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Erek Adams (May 08)
Re: can't start snort Erek Adams (Apr 10)
Re: Alert but NOT log? Erek Adams (Apr 04)
Re: HOME_NET question... Erek Adams (Apr 22)
Re: Two content variables Erek Adams (Apr 05)
Re: Snort IGNORES var HOME_NET Erek Adams (May 07)
Re: help! Erek Adams (Apr 18)
Re: snort not logging to log files.. Erek Adams (Apr 19)
RE: Setting the nic up ?? Erek Adams (Jun 10)
Re: writing snort rules ? <newbies> Erek Adams (Apr 22)
Re: Lost in the config file Erek Adams (Jun 27)
Re: Dynamically loading/unloading pre-processors... Erek Adams (May 10)
Re: Snort sendme email Erek Adams (Apr 18)
Re: Snort rules Erek Adams (Apr 25)
Re: unsubscribe Erek Adams (Apr 02)
Re: Tuning snort rules. Erek Adams (Apr 24)
Re: snort + mysql Erek Adams (May 30)
Re: Flexresp problem Erek Adams (Apr 14)
Re: Snort rules update Erek Adams (Apr 03)
Re: configure snort to drop payloads Erek Adams (Apr 17)
Re: List of IP Address Erek Adams (Jun 26)
Re: Best snort list replier / contributor Erek Adams (Apr 15)
Re: Getting MYSQL support compiled Erek Adams (May 21)
Re: Current Rule Set Erek Adams (Jun 10)
Re: icmp: is this real? Erek Adams (Apr 01)
RE: flags Erek Adams (Jun 11)
RE: I need some serious help Erek Adams (Jun 11)
Re: Ignoring all traffic from a certain network Erek Adams (Apr 15)
Re: syslog Erek Adams (Jun 06)
Re: Using Snort for Wireless Erek Adams (Apr 03)
Re: Snort in a switched environment Erek Adams (May 14)
RE: flags Erek Adams (Jun 09)
Re: remove Erek Adams (May 03)
Re: shellcode error Erek Adams (May 30)
Re: Two content variables Erek Adams (Apr 05)
RE: snort not logging to log files.. Erek Adams (Apr 22)
Re: multiple HTTP_PORTS Erek Adams (Jun 20)
RE: snortconf via web Erek Adams (May 03)
RE: Filesize limit exceeded Erek Adams (May 01)
Re: (no subject) Erek Adams (Apr 14)
Re: not detecting common intrusion Erek Adams (Jun 26)
Re: a little confusion Erek Adams (Apr 17)
Re: icmp i want to ignore Erek Adams (Jun 05)
Re: Lost in the config file Erek Adams (Jun 27)
Re: How to ignore scan from a host Erek Adams (Apr 16)
Re: Syslog output other file Erek Adams (Apr 19)
Re: interface name in alert? Erek Adams (Apr 11)
RE: FreeBSD + Mysql + Snort Erek Adams (Apr 17)
Re: configure snort to drop payloads Erek Adams (Apr 14)
Re: Remote GUI Erek Adams (May 03)
Re: defining $external_net Erek Adams (Apr 25)
Re: Snorting the MAC address Erek Adams (Apr 11)
Re: Active Firewalling Erek Adams (Apr 14)
Re: can't start snort Erek Adams (Apr 11)
Re: configure snort to drop payloads Erek Adams (Apr 16)
Re: Best snort list replier / contributor Erek Adams (Apr 15)
Re: Segmentation fault (core dumped) Erek Adams (Apr 15)
Re: Too many stealth alerts Erek Adams (Apr 15)
Re: HP Printing Erek Adams (May 08)
Re: Flexresp problem Erek Adams (Apr 20)
RE: Snort rules touble. Erek Adams (Jun 21)
Re: help! Erek Adams (Apr 19)
Re: icmp: is this real? Erek Adams (Mar 31)
RE: Cisco PIX firwalls.. Erek Adams (Apr 15)
Re: log ftp servers in our network Erek Adams (Apr 14)
Re: correlation on a snort sensor Erek Adams (Apr 14)
RE: Best snort list replier / contributor Erek Adams (Apr 15)
Semi-OT: Developer Thanks? Erek Adams (May 07)
Re: SYN flood detection Erek Adams (May 10)
RE: Snort rules touble. Erek Adams (Jun 21)
Re: shellcode error Erek Adams (May 31)
RE: Snort rules touble. Erek Adams (Jun 21)
Re: No logging from localhost? Erek Adams (May 03)
Re: I found a bug Erek Adams (Apr 15)
Re: I need some serious help Erek Adams (Jun 11)
Re: Mandrake 8.0 Erek Adams (Apr 22)
Re: writing to log file and running a script at once??? Erek Adams (Apr 22)
Re: Syslog output other file Erek Adams (Apr 19)
Re: As a newbie, two questions Erek Adams (May 03)
Re: Snort and ACID on separate systems? Erek Adams (Jun 18)
Re: Snort & multi-port ethernet cards Erek Adams (Jun 20)
Re: portscan log Erek Adams (Apr 01)
Re: Snort and the Windows Family... Erek Adams (Apr 05)
Re: Snort Working Mechanism Erek Adams (Apr 03)
Re: Network traffic forwarder (hardware device) Erek Adams (Jun 28)
Re: Flexresp problem Erek Adams (Apr 15)
Re: unsubscribe Erek Adams (Jun 11)

Eric Garnel

Re: Help with tcpdump log rotation Eric Garnel (May 03)
newbie pass rule question Eric Garnel (Jun 18)
I think I know the answer to this, but not 100% sure Eric Garnel (Jun 26)
newbie log question Eric Garnel (May 02)

Erik Melander

Re: explicitly telling snort not to log to /var/log/snort Erik Melander (Apr 02)

Ernesto T. Negron

Snort 1.8 Win32 Ernesto T. Negron (May 01)

ESR

Invalid Sig ID ESR (May 19)

Estes, Matt CPR / FCBS

RE: mysql archive tool Estes, Matt CPR / FCBS (Apr 30)
RE: Too many stealth alerts Estes, Matt CPR / FCBS (Apr 15)
RE: Snort and MySQL ./configure problems Estes, Matt CPR / FCBS (Apr 17)
Too many stealth alerts Estes, Matt CPR / FCBS (Apr 15)
RE: snort current doesnt run Estes, Matt CPR / FCBS (Apr 04)
RE: snort not logging to database Estes, Matt CPR / FCBS (May 22)
Stealth Packets Ok? Estes, Matt CPR / FCBS (Apr 10)
RE: Need help with a rule Estes, Matt CPR / FCBS (Apr 10)

Estes, Matt: CPR / FCBS

RE: nmap scans don't appear in portscan.log Estes, Matt: CPR / FCBS (Apr 02)
RE: spp_portscan and ACID Estes, Matt: CPR / FCBS (Apr 02)
Database event sorting Estes, Matt: CPR / FCBS (Apr 02)
RE: VAR and IP lists Estes, Matt: CPR / FCBS (Apr 02)

Estes, Matt PEO EIS CPR / FCBS

RE: portscan ? Estes, Matt PEO EIS CPR / FCBS (Jun 10)

Fage Martin

not logging portscans Fage Martin (May 23)

Fallon, Benjamin

RE: nmap scans don't appear in portscan.log Fallon, Benjamin (Apr 02)
RE: WG: Demarc Security Update Advisory Fallon, Benjamin (Apr 18)
RE: REMOVE Jason Haar from the list! Fallon, Benjamin (May 07)
RE: Snort 1.8 Win32 Fallon, Benjamin (May 01)
RE: ACID Problem Fallon, Benjamin (May 16)
RE: snort configuration using gui... Fallon, Benjamin (May 20)

Federico

Ri: Re: rule processing. Federico (Apr 01)

Federico Lombardo

insertion and evasion Federico Lombardo (Apr 18)
1.8.5 ? Federico Lombardo (Apr 03)
missing declaration makes 1.8.6 to segfault Federico Lombardo (Apr 09)

Federico Rena

(no subject) Federico Rena (Apr 10)
(no subject) Federico Rena (Apr 10)
up the snort ides Federico Rena (Apr 05)
(no subject) Federico Rena (Apr 09)
up the snort ides Federico Rena (Apr 05)
(no subject) Federico Rena (Apr 10)
Problem with ACID and Solution. Federico Rena (Jun 06)

Finney Charles E

RE: Spurious Alerts? Finney Charles E (Apr 30)
Spurious Alerts? Finney Charles E (Apr 30)

F.M. Taylor

Re: Multiple Content (not working?) F.M. Taylor (May 15)
OT: Workstation security assurance F.M. Taylor (Apr 30)
OT: workstation security assurance F.M. Taylor (Apr 30)
Re: Multiple Content (not working?) F.M. Taylor (May 17)
Re: ACID and PHP F.M. Taylor (May 14)
Re: Playing wavs or mp3 on intrusion detect F.M. Taylor (May 13)

Francis Cianfrocca

Re: fragroute vs. snort: the tempest in a teacup Francis Cianfrocca (Apr 18)

François Jan

PureSecure is crazy François Jan (Jun 17)
Re: PureSecure is crazy François Jan (Jun 18)

Francois Le Bec

unsubscribe Francois Le Bec (Apr 02)

Frank

ACID - Alert Group email problem Frank (Jun 26)

Frank Knobbe

Re: LaBrea Frank Knobbe (Jun 05)
Re: stream4 oddity Frank Knobbe (Apr 24)
RE: Problems logging to syslog and mysql simultaneously Frank Knobbe (Jun 21)
RE: SSL CodeRed et al Frank Knobbe (May 28)
SnortSam update: PIX and Cisco ACLs Frank Knobbe (May 06)
RE: rule question Frank Knobbe (Apr 25)
RE: stream4 oddity --- Update Frank Knobbe (Apr 24)
Re: Cisco PIX firwalls.. Frank Knobbe (Apr 17)
Re: Changing the filename format for alerts Frank Knobbe (Jun 14)
RE: Compiling snort on Win32 Frank Knobbe (Jun 03)
RE: Blocking individual IP's Frank Knobbe (Apr 13)
Re: Fragroute binaries for WindowsNT/2000 (Off- Topic) Frank Knobbe (Apr 30)
Re: Gigabit snort? Frank Knobbe (Apr 13)
Re: running a script when a match is found Frank Knobbe (May 07)
Re: LaBrea Frank Knobbe (Jun 05)
Re: What's the fuss about string matching ? Frank Knobbe (May 28)
stream4 oddity Frank Knobbe (Apr 23)
SnortSam update Frank Knobbe (Apr 24)

Frank Lewandowski

Core dumping with more then 1 rule enabled Frank Lewandowski (Jun 07)
RE: Core dumping with more then 1 rule enabled - SUMMARY Frank Lewandowski (Jun 08)

Fraser Hugh

RE: Best real-time alerting tool Fraser Hugh (Jun 07)
RE: Best real-time alerting tool Fraser Hugh (Jun 06)

Fuchs Bernhard

RE: Snort and network taps Fuchs Bernhard (Apr 24)
not really off topic Fuchs Bernhard (Apr 10)
Problems on XP Fuchs Bernhard (Apr 17)
where can i find out the meaning Fuchs Bernhard (Apr 09)

Fyodor

Re: LaBrea Fyodor (Jun 05)

Gabriel Zabal

Newbie need advice ! Gabriel Zabal (Apr 26)

Galappatti, Kishantha

snort logging to sybase Galappatti, Kishantha (Apr 24)

Ganu Skop

snort_stat Ganu Skop (Apr 11)
blocking Ganu Skop (May 16)
alert file problem Ganu Skop (Jun 20)
centralized log Ganu Skop (May 13)
SNMP EXCLUDE Ganu Skop (Apr 05)

Gavin O'Connor

Demarc database schema issue Gavin O'Connor (Apr 14)
Demarc database schema issue Gavin O'Connor (Apr 02)

Gerardo Gregory

Re: www.snort.org down? Gerardo Gregory (Apr 17)

Gfm

PostgreSQL Indexes Gfm (Jun 11)

Gianluca Marcari

Re: LaBrea Gianluca Marcari (Jun 06)

gilles . lami

snort 1.8.6 and AIX 4.3.3 gilles . lami (Jun 22)
snort 1.8.6 and AIX 4.3.3 gilles . lami (Jun 19)

Glenn Forbes Fleming Larratt

Re: Don't see traffic unless have IP Glenn Forbes Fleming Larratt (May 18)
Re: Setting the nic up ?? Glenn Forbes Fleming Larratt (Jun 10)

Glenn Larsson

Re: Snort Log Despoofer Glenn Larsson (May 16)
2 questions: Timeformat + ARP Despoofing. Glenn Larsson (May 21)
CSV Output problems... Glenn Larsson (May 23)
Snort Log Despoofer Glenn Larsson (May 15)
Re: Price for "vanilla Snort" (no bells and whistles) Glenn Larsson (May 07)
Re: Snort-users digest, Vol 1 #1890 - 10 msgs Glenn Larsson (May 16)
Re: 2 more questions: Glenn Larsson (May 23)
2 more questions: Glenn Larsson (May 23)
Price for "vanilla Snort" (no bells and whistles) Glenn Larsson (May 06)
New version: Snort Log Despoofer. Glenn Larsson (May 21)
Re: Snort-users digest, Vol 1 #1861 - 13 msgs Glenn Larsson (May 08)
Possible Snort bug. Glenn Larsson (May 07)

Glenn Mansfield Keeni

Re: FW: heya - Glenn Mansfield Keeni (Jun 10)

Gongya Yu

port 22 scan Gongya Yu (Jun 04)

Grace Pittmon

Re: cmd.exe Grace Pittmon (Apr 29)

Gray . Brendan

RE: WEB-ATTACKS id command attempt Gray . Brendan (Apr 15)

greg

Help greg (Jun 11)

Gregory D Hough

Re: Snort installation Gregory D Hough (Jun 28)
[spp_portscan] Gregory D Hough (Jun 20)
Re: [Snorting 2 NICs] Gregory D Hough (Jun 11)
[Snorting 2 NICs] Gregory D Hough (Jun 10)

Greg Robinson

Re: Snort and ACID on separate systems? Greg Robinson (Jun 18)
Re: Wireless monitoring Greg Robinson (May 22)

Greg Wright

Snort In the news: RE: Fragroute Greg Wright (Apr 22)
Count option WAS smtp rcpt to overflow Greg Wright (Jun 13)

Groce, Jonathan (CRTATL)

SNMP Problems Groce, Jonathan (CRTATL) (May 02)

Grzegorz Flak

Problem running Snort on WinXP Grzegorz Flak (Apr 02)
RE: Xp and Snort Grzegorz Flak (Apr 02)

G Saoutine

ACID and PHP G Saoutine (May 14)

Guy Bruneau

Sensor automated signature updates Guy Bruneau (May 24)

hackerwacker

Re: Snort getting overloaded by http traffic: hackerwacker (Jun 25)

Ha Hoang

(no subject) Ha Hoang (Apr 13)
Snort installation Ha Hoang (Jun 28)
Rule Sets Ha Hoang (Apr 13)
Snort installation Ha Hoang (Jun 28)

Hall, Duane

RE: FreeBSD + Mysql + Snort Hall, Duane (Apr 17)
FreeBSD + Mysql + Snort Hall, Duane (Apr 17)
Remove sensor from Mysql using ACID Hall, Duane (May 08)
ACID Hall, Duane (Jun 11)
RE: FreeBSD + Mysql + Snort Hall, Duane (Apr 17)
Current Rule Set Hall, Duane (Jun 10)
FreeBSD + Mysql + Snort Hall, Duane (Apr 17)

Hans-Cees Speel

unable to compile latest with mysql on linux Hans-Cees Speel (May 01)

Harald Finnaas

Delete sensors from DB Harald Finnaas (Apr 28)
"Flow" problem Harald Finnaas (Apr 28)
re: "Flow" problem Harald Finnaas (Apr 28)
Re: Odd question... Harald Finnaas (Apr 30)

Harry Putnam

Re: real basic starter rules Harry Putnam (Apr 27)
real basic starter rules Harry Putnam (Apr 24)
Re: real basic starter rules Harry Putnam (Apr 26)
Re: real basic starter rules Harry Putnam (Apr 25)

Haubein, Ted

Re: Libpcap library/headers not found... Haubein, Ted (Apr 02)

Hauser Marcel

RE: TCP ******S* portscan Hauser Marcel (Apr 05)
Re: TCP ******S* portscan Hauser Marcel (Apr 05)

Hawrylkiw, Dan G

RE: Anomalous packet logged by Snort Hawrylkiw, Dan G (Apr 08)

Hector Urdaneta

Solaris checksum problem Hector Urdaneta (Jun 04)

Helderdp

Playing wavs or mp3 on intrusion detect Helderdp (May 13)

Henk Wevers

snort 1.9.x would not compile on FreeBSD 4.5 Henk Wevers (Jun 04)
snort 1.9.x would not compile on FreeBSD 4.5 Henk Wevers (Jun 04)
Re: snort 1.9.x would not compile on FreeBSD 4.5 (snapshot build?) Henk Wevers (Jun 04)
Re: snort 1.9.x would not compile on FreeBSD 4.5 Henk Wevers (Jun 04)

Hever C. Rocha - N.O.C

Fragroute binaries for WindowsNT/2000 (Off- Topic) Hever C. Rocha - N.O.C (Apr 30)

Hicks, John

RE: OT: IP Blocks by country/region? Hicks, John (Jun 13)
RE: Attention: Win32 Users - Snort 1.8.6b121 Ready - W/Run As Service Hicks, John (May 30)
RE: Tying alerts to hostnames? Hicks, John (Jun 18)
RE: OFF-TROPIC - Boot Disk Hicks, John (May 14)
RE: WinPcap 2.3 and Win2k Hicks, John (Jun 18)
RE: SETTING UP SNORT Hicks, John (May 27)
RE: Snort installation Hicks, John (Jun 28)
RE: WinPcap 2.3 and Win2k Hicks, John (Jun 18)
RE: Setting up a Windowz Interface to monitor with no IP Address Hicks, John (Jun 28)
RE: Issue with List/Sourceforge Hicks, John (Jun 26)
RE: re: 1. Network World IDS report (Jason Haar) Hicks, John (Jun 27)
RE: error initializing the network interface on win 2k Hicks, John (Jun 13)
RE: Preventing Attacks Hicks, John (Jun 26)
Stubbourn Pcap Error Hicks, John (May 27)
RE: ACID enhancement Hicks, John (Jun 07)
RE: Playing wavs or mp3 on intrusion detect Hicks, John (May 14)

Hilton De Meillon

recommendations !? Hilton De Meillon (Apr 05)
IDS126/X11_OUTGOING_XTERM ? Hilton De Meillon (Jun 13)
snort & mysql Hilton De Meillon (Apr 13)
RE: Exploit? Hilton De Meillon (Jun 13)
Where are portscans stored ? Hilton De Meillon (Jun 19)
howto test snort ? Hilton De Meillon (Apr 24)

Howell, Paul

interface name in alert? Howell, Paul (Apr 11)

How ya Doin

GB Snort How ya Doin (Apr 14)

Hugh Brown

RE: smtp rcpt to overflow Hugh Brown (Jun 05)

Hugo Ferr

Snort upgrade Hugo Ferr (May 23)
Re: Snort Implementation Guide - ACID-MySQL-Redhat7.2 Hugo Ferr (Jun 05)
Re: sorry...upgrade question again Hugo Ferr (May 29)
Re: (no subject) Hugo Ferr (May 31)
Re: schema version 104 Hugo Ferr (May 31)
shellcode error Hugo Ferr (May 30)
flexresp on 1.8.6 with red hat 7.2 Hugo Ferr (May 30)
Re: LaBrea Hugo Ferr (Jun 07)
upgrade Hugo Ferr (May 27)
Re: LaBrea Hugo Ferr (Jun 06)
Re: schema version 104 Hugo Ferr (May 31)
Re: shellcode error Hugo Ferr (May 31)
product description Hugo Ferr (May 31)
smtp rcpt to overflow Hugo Ferr (Jun 05)
schema version 104 Hugo Ferr (May 30)
sorry...upgrade question again Hugo Ferr (May 28)
(no subject) Hugo Ferr (May 31)
Re: Snort Implementation Guide - ACID-MySQL-Redhat7.2 Hugo Ferr (Jun 04)
Re: RV: portscan Hugo Ferr (May 31)
Re: LaBrea Hugo Ferr (Jun 06)
LaBrea Hugo Ferr (Jun 05)
Re: LaBrea Hugo Ferr (Jun 09)
Re: shellcode error Hugo Ferr (May 30)
Re: shellcode error Hugo Ferr (May 31)
Re: A tool to Archive & delete mysql ( snortdb ) records .. Hugo Ferr (Jun 03)
Re: sorry...upgrade question again Hugo Ferr (May 30)

Hutchinson, Andrew

RE: How to create the DB indices with postgresql Hutchinson, Andrew (Jun 27)
RE: How to create the DB indices with postgresql Hutchinson, Andrew (Jun 27)
RE: PostgreSQL Indexes Hutchinson, Andrew (Jun 12)
RE: PostgreSQL Indexes Hutchinson, Andrew (Jun 13)
RE: Snort Topology Configuration Hutchinson, Andrew (Jun 24)

Ian Macdonald

Re: [Snort-users] Rép. : [Snort-users] demarc: validate Ian Macdonald (May 16)
Database maintence scripts Ian Macdonald (May 02)
Re: Snort, MySQL, Acid Ian Macdonald (May 07)
Sql syntax error logging to mysql Ian Macdonald (Apr 09)
RE: Fragments and stuff Ian Macdonald (Apr 30)
Re: Don't see traffic unless have IP Ian Macdonald (May 22)
Tuning snort rules. Ian Macdonald (Apr 23)
Re: Alerts Ian Macdonald (Jun 13)
Re: Snort, MySQL, Acid Ian Macdonald (May 07)
Re: PureSecure 1.6 Ian Macdonald (May 15)
Tag: and mysql and Demarc. Ian Macdonald (Apr 25)
Compiling snort on Win32 Ian Macdonald (May 31)
Re: snort occupy all cpu time? Ian Macdonald (Jun 18)
Re: PureSecure is crazy Ian Macdonald (Jun 18)
Fragments and stuff Ian Macdonald (Apr 30)
Broken Signature SMTP RCPT TO Ian Macdonald (May 01)
Converting Hex to Ascii in mysql Ian Macdonald (May 14)
Re: 2 NICS Ian Macdonald (May 23)
Re: Tuning snort rules. Ian Macdonald (Apr 24)

Imran William Smith

Re: Snort and SysLogging, warning Imran William Smith (Jun 20)
Re: OT: IP Blocks by country/region? Imran William Smith (Jun 13)
Re: rule for Yahoo or Hotmail messengers Imran William Smith (Jun 17)
Re: Snort getting overloaded by http traffic: Imran William Smith (Jun 25)
Re: Mysql problem Imran William Smith (Jun 23)
Questionnaire for FAQ on 'how many alerts does snort receive'. Imran William Smith (Jun 09)

Infinity

New Install Infinity (Jun 19)
RE: New Install Infinity (Jun 19)
RE: New Install Infinity (Jun 19)

Ing. Daniel Manrique

STEALTH ACTIVITY (NULL scan) ??? Ing. Daniel Manrique (Apr 24)

james

Re: RE: snort performance james (Apr 17)
Snarf will not DNS james (Apr 01)
Re: Alert but NOT log? james (Apr 04)
Re: RE: snort performance james (Apr 17)
Snarf will not DNS james (Apr 02)
Re: archive snort logs? james (Apr 04)
Re: Using Snort for Wireless james (Apr 03)

James Ainslie

Snort Rules Database James Ainslie (Apr 24)
Snort rules James Ainslie (Apr 25)
Re: OT: ipfilter Suggestions for Snort Use James Ainslie (Apr 23)

James Ashton

barnyard James Ashton (Jun 09)
RE: flags James Ashton (Jun 09)
flags James Ashton (Jun 08)
Re: flags James Ashton (Jun 08)

James Harrison

Unified Alert Output and IP Reversal James Harrison (Apr 11)

James Hoagland

Re: configure snort to drop payloads James Hoagland (Apr 18)
Re: Snarf will not DNS James Hoagland (Apr 02)
Re: snort-stable-snapshot.tar.gz & snort-daily.tar.gz James Hoagland (Jun 01)
Re: Core dumping with more then 1 rule enabled James Hoagland (Jun 08)
Re: Snorting the MAC address James Hoagland (Apr 11)
Re: Snort on HPUX James Hoagland (Apr 18)
SnortSnarf version 020516.1 now available James Hoagland (May 16)
Re: configure snort to drop payloads James Hoagland (Apr 17)
Re: Spade Joint Prob table output James Hoagland (Apr 02)
Re: Looking for tool to generate isp/domain notification emails.... James Hoagland (May 11)

janaki ramachandran

Snort fails to log data janaki ramachandran (Apr 01)

Jari Pirhonen

Snort reports, PureSecure Jari Pirhonen (May 24)

jas

RE: Snort front ends jas (Jun 13)
RE: Snort front ends jas (Jun 13)
Snort front ends jas (Jun 12)

Jason Brvenik

RE: ACTION: Snort user's group in NOVA ? Jason Brvenik (Apr 29)

Jason Burnett

alerts Jason Burnett (Apr 23)

Jason Gauthier

*NIX ping alerts Jason Gauthier (Jun 24)
RE: *NIX ping alerts Jason Gauthier (Jun 24)
RE: Snort rules touble. Jason Gauthier (Jun 21)
3 Snort, 1 MySQL Jason Gauthier (Jun 26)
Issue with List/Sourceforge Jason Gauthier (Jun 26)
RE: Snort rules touble. Jason Gauthier (Jun 21)
RE: 3 Snort, 1 MySQL Jason Gauthier (Jun 28)
RE: Snort rules touble. Jason Gauthier (Jun 21)
Snort rules touble. Jason Gauthier (Jun 21)
RE: *NIX ping alerts Jason Gauthier (Jun 24)

Jason Haar

Can you simply merge separate Snort SQL databases? Jason Haar (Apr 30)
Re: Can you simply merge separate Snort SQL databases? Jason Haar (May 01)
Re: REMOVE Jason Haar from the list! Jason Haar (May 07)
Re: Snort and network taps Jason Haar (Apr 23)
Re: snort-users mailinglist trigger snort Jason Haar (Apr 25)
Re: Snort getting overloaded by http traffic: Jason Haar (Jun 25)
More on the "BAD TRAFFIC udp port 0" front Jason Haar (May 06)
Weird issue with 1.8.6 and SMTP alerts Jason Haar (May 19)
[Slightly OT]: what syslog daemon actually ignores the client timestamp? Jason Haar (Jun 27)
Re: SMTP RCPT TO overflow Jason Haar (May 06)
Network World IDS report Jason Haar (Jun 26)
Re: Re: fragroute vs. snort: the tempest in a teacup Jason Haar (Apr 18)
Re: SMTP RCPT TO overflow Jason Haar (Apr 25)
Re: Playing wavs or mp3 on intrusion detect Jason Haar (May 13)
Re: Snort and network taps Jason Haar (Apr 23)
Re: monitoring https / SSL Jason Haar (May 02)
Re: What's the fuss about string matching ? Jason Haar (May 27)

Jason Lewis

RE: Snort Solaris 8 with quad card Jason Lewis (Apr 02)

Jason Martin

Configuration HELP! Jason Martin (Jun 12)
: Configuration HELP! (understanding alerts and pro xies) Jason Martin (Jun 12)

Jason Monroe

mysql archive tool Jason Monroe (Apr 29)

Jason Withrow

GUI Help Needed Jason Withrow (Apr 30)
Windows SNORT XML Logs Jason Withrow (Apr 25)
RE: Compiling snort on Win32 Jason Withrow (Jun 02)
RE: REMOVE Jason Haar from the list! Jason Withrow (May 07)

Jason Yates

Re: configure --with-mysql= ? Jason Yates (Apr 02)
Re: Snorting the MAC address Jason Yates (Apr 11)
acid and udp ports Jason Yates (May 29)
portscan log Jason Yates (Apr 01)
spp_portscan and ACID Jason Yates (Apr 01)
Re: nmap scans don't appear in portscan.log Jason Yates (Apr 01)
fragrouter missed beginning Jason Yates (Apr 24)

JC

Keeping a 2 week running backup of MySQL snortdb JC (May 01)

J. Craig Woods

Command line overrides? J. Craig Woods (Apr 30)
Re: Subliminal html in spam? J. Craig Woods (Apr 04)
Re: snortconf via web J. Craig Woods (May 05)
easy one... J. Craig Woods (Apr 17)

jdell

IDS Policy Manager 1.2 Release jdell (Apr 01)

Jean Michel BARBET

EXPLOIT ssh CRC32 false alerts Jean Michel BARBET (Jun 17)

Jeff Anderson

RE: I'd rather not get the message Jeff Anderson (Jun 04)

JEFF Collins

Email alert and porscan.log on a daily basis JEFF Collins (May 31)

Jeff Dell

RE: newbie: merging rulesets Jeff Dell (May 05)
RE: snort configuration using gui... Jeff Dell (May 20)
RE: snortconf via web Jeff Dell (May 03)
RE: syslog Jeff Dell (Jun 06)
RE: pid file, how do I create one? Jeff Dell (Apr 30)

Jeff Nathan

Re: not detecting common intrusion Jeff Nathan (Jun 27)
Re: No more -z all? Jeff Nathan (May 12)
FAQ update regarding -z Jeff Nathan (May 13)
Re: Gigabit snort? Jeff Nathan (Apr 17)
Re: Snort and network taps Jeff Nathan (Apr 23)
Re: Re: Off topic: Thousands of traceroutes ? Jeff Nathan (May 13)
Re: No more -z all? Jeff Nathan (May 13)
Re: Snort+flexresp Jeff Nathan (Apr 02)
Re: Snort and network taps Jeff Nathan (Apr 23)
Re: Connecting snort bidirectionnal. Jeff Nathan (May 23)
snort uberscript Jeff Nathan (Apr 23)
Re: arp spoof Jeff Nathan (Jun 28)
Re: 2 more questions: Jeff Nathan (May 23)
Re: Phil is coming out of the closet Jeff Nathan (Apr 02)
Re: Snort+flexresp Jeff Nathan (Apr 02)
Re: Disable spoofing ARP in kill packets Jeff Nathan (Apr 17)

Jeffrey Taylor

Re: port lists for 1.8 Jeffrey Taylor (Jun 27)
Re: Preventing Attacks Jeffrey Taylor (Jun 26)
Re: Preventing Attacks Jeffrey Taylor (Jun 27)
Re: port lists for 1.8 Jeffrey Taylor (Jun 26)

Jeff Taylor

Re: Preventing Attacks Jeff Taylor (Jun 27)

Jeremy

1.8.6 and tcpdump format Jeremy (May 22)

Jerome Magnin

snort 1.8.6 crashing when running two instances on the same interface with Openbsd Jerome Magnin (Apr 15)

Jerry Shenk

Snort front ends Jerry Shenk (Jun 13)
RE: Snort front ends Jerry Shenk (Jun 13)
RE: Snort front ends Jerry Shenk (Jun 13)

Jessup, Justin

RE: Snort-users digest, Vol 1 #1962 - 13 msgs Jessup, Justin (Jun 12)

Jesus Couto

1.8.6 problem: Misdetection and hangup Jesus Couto (Jun 04)

Jev

-i any ? Jev (May 14)

Jevoš Peter

snort_stat.pl Jevoš Peter (May 27)
snort_stat.pl Jevoš Peter (May 29)

Jhumri Tilayia

Don't see traffic unless have IP Jhumri Tilayia (May 18)
Snort user's group in NOVA ? Jhumri Tilayia (Apr 26)
SMTP RCPT TO overflow Jhumri Tilayia (Apr 25)

jianwen pi

update rules set automatically jianwen pi (Apr 05)

Jim Forster

New Forums Jim Forster (Jun 06)

Jim Geovedi

Re: Firewall Tester 0.6 Jim Geovedi (Apr 09)

Jim Grossl

RE: SSL CodeRed et al Jim Grossl (May 28)

Jim Williams

ignore ping Jim Williams (May 24)

Joe Magee

Preventing Cyberattacks Webcast Joe Magee (May 22)

Joe Matusiewicz

Re: Is this a valid traffic? Joe Matusiewicz (Apr 03)
Re: SMTP Virus Gateway Joe Matusiewicz (Jun 14)

Joe McAlerney

Re: idmef on FreeBSD Joe McAlerney (Apr 08)
Re: Force a server to send fragments? Joe McAlerney (Apr 02)
Re: Ignore ICMP ping Joe McAlerney (May 31)
Re: Re: excluding a host from rule Joe McAlerney (May 30)

Joe Pampel

Re: Snort-users #1972 OT Email/AV Ranting Joe Pampel (Jun 17)
Re: Snort in a switched environment Joe Pampel (May 15)
re: 1. Network World IDS report (Jason Haar) Joe Pampel (Jun 27)
Re: Vol 1 #1833 Msg#10 Joe Pampel (Apr 26)
Re: Snort-users digest, Vol 1 #1929 - 1 msg Joe Pampel (May 31)
Message: 5 - What's the best setup Joe Pampel (Jun 17)

Joe Smith

RE: Cisco PIX firwalls.. Joe Smith (Apr 15)

john

SQLsnake - any able to create a sig for this one? john (May 21)
arp spoof john (Jun 27)
SQLsnake - any able to create a sig for this one? john (May 21)
(no subject) john (Jun 11)
testing snort john (Jun 14)
Re: Snort-users digest, Vol 1 #1914 - 6 msgs john (May 26)
Re: shellcode error john (May 31)

John Bradberry

Excluding hosts from spp_unicode John Bradberry (May 11)

John Goggan

RE: Buffer too small for packet.dll? (was: Error initializing NIC) John Goggan (Apr 24)

John Hally

snort_stat.pl John Hally (Apr 18)
Snort dying unexpectedly John Hally (Apr 25)
RE: Snort dying unexpectedly John Hally (Apr 25)
ACID Problem John Hally (May 15)
snort_stat.pl John Hally (May 21)
RE: Snort dying unexpectedly John Hally (Apr 25)
redworm sanity check John Hally (Jun 08)

John Maestrale

SYSLOG John Maestrale (May 15)
Remote Syslog John Maestrale (May 09)
RE: A tool to Archive & delete mysql ( snortdb ) re cords .. John Maestrale (Jun 03)
(no subject) John Maestrale (May 20)
2 NICS John Maestrale (May 23)
SYSLOG John Maestrale (May 14)
(no subject) John Maestrale (May 29)
Hotmail John Maestrale (Jun 19)
SELECT RULES John Maestrale (Jun 13)

John-Magne Bredal

WEB-ATTACKS id command attempt John-Magne Bredal (Apr 15)

John Ruff

RE: Best real-time alerting tool John Ruff (Jun 09)

John Sage

Re: registered services John Sage (May 06)
Re: HOME_NET question... John Sage (Apr 22)
icmp: is this real? John Sage (Mar 31)
Re: Lost in the config file John Sage (Jun 27)
Re: Help with tcpdump log rotation John Sage (May 11)
Re: snortpp missing? John Sage (May 27)
Re: what is good John Sage (Apr 21)
Re: Preventing Attacks John Sage (Jun 28)
Re: ./configure --with-mysql= ? John Sage (Apr 02)
Re: Mandrake 8.2 John Sage (May 26)
ACID default sort order John Sage (May 07)
Re: ACID John Sage (Jun 01)
Re: icmp: is this real? John Sage (Mar 31)
Re: Playing wavs or mp3 on intrusion detect John Sage (May 13)
Re: -B option John Sage (May 18)
Re: ./configure --with-mysql= ? John Sage (Apr 02)
Re: Subliminal html in spam? John Sage (Apr 06)
Re: Which rules to use for snort ? John Sage (Jun 03)
Re: Re: Off topic: Thousands of traceroutes ? John Sage (May 14)
[Re: snortpp missing?: Mail System Error - Returned Mail] John Sage (May 27)
Re: whitehats.com is online again John Sage (Apr 06)
Subliminal html in spam? John Sage (Apr 04)
Re: Tying alerts to hostnames? John Sage (Jun 17)
Re: Same question again.. John Sage (May 25)
Re: OT queries on acid in confusion... John Sage (Jun 19)
Re: snort and mysql John Sage (May 13)
Re: Re: Off topic: Thousands of traceroutes ? John Sage (May 13)
ACID: sort order for email "alerts full" John Sage (Apr 07)
Re: Lost in the config file John Sage (Jun 26)
Re: Snort Interfaces problem (Win32) John Sage (Jun 24)
Re: cavo stealth John Sage (May 20)
Re: Exclude Source? John Sage (Jun 09)
./configure --with-mysql= ? John Sage (Apr 02)
Re: I'd rather not get the message John Sage (Jun 02)
Re: icmp: is this real? John Sage (Apr 01)
Re: arp spoof John Sage (Jun 28)
Re: Not Compiled for MySQL John Sage (May 25)
Re: (no subject) John Sage (Apr 10)
Re: icmp: is this real? John Sage (Apr 01)
configure --with-mysql= ? John Sage (Apr 02)

John Stroud

RE: (no subject) John Stroud (May 31)
RE: SNORT rule John Stroud (May 27)

Jonathan

OpenBSD, snort, Two nic's outside network Jonathan (Jun 22)
snort 99%cpu..not hanging Jonathan (Jun 30)

Jon Hart

Re: proper usage of $SHELLCODE_PORTS ? Jon Hart (Apr 22)
Re: proper usage of $SHELLCODE_PORTS ? Jon Hart (Apr 21)
proper usage of $SHELLCODE_PORTS ? Jon Hart (Apr 21)

Jon Ottar Runde

Re: Snort installation document for review. Jon Ottar Runde (Apr 23)

Jon Quiros

Re: OT queries on acid in confusion... Jon Quiros (Jun 19)
OT queries on acid in confusion... Jon Quiros (Jun 18)
Re: Snort Topology Configuration Jon Quiros (Jun 24)
Re: Snort Topology Configuration Jon Quiros (Jun 24)
Re: OT queries on acid in confusion... Jon Quiros (Jun 19)

Jordi Vila

RE: IDS126/X11_OUTGOING_XTERM ? Jordi Vila (Jun 13)

Jose Luis Medina

Re: another switch question Jose Luis Medina (May 16)

Jose Luis Onis

Converting data_payload to a readable format Jose Luis Onis (May 10)

Jose Nazario

Re: Snort exploits Jose Nazario (Apr 25)

Joseph Inserra

portscan-ignorehosts question Joseph Inserra (Jun 04)

Joshua James

Re: SMTP Virus Gateway Joshua James (Jun 14)

Joshua Laase

Question about alert output configuration. Joshua Laase (Apr 29)

JPP

Re: ERROR LOG JPP (Apr 18)

jromariz

Logging payload to syslog jromariz (Jun 11)

Juan Pablo Villaverde

Stable Snort Rules fails? Juan Pablo Villaverde (May 31)
Rules troubles in startup Juan Pablo Villaverde (Jun 26)

Juergen Fiedler

xml plugin Juergen Fiedler (May 14)

Justin Honold

RE: OT: ipfilter Suggestions for Snort Use Justin Honold (Apr 23)

Justin M. Parker

Re: Snort in a switched environment Justin M. Parker (May 14)
Re: Snort in a switched environment Justin M. Parker (May 14)

kai . hanisch

Logfile Problem kai . hanisch (May 07)

kamesh_rajaram

Idea my snort database..!! kamesh_rajaram (Apr 05)

Karen Marino

Upgrading DB schema Karen Marino (May 15)

Karl Lovink

snort problem on HP-UX 11.00 and TokenRing Karl Lovink (May 02)
HP-UX and snort still crashed Karl Lovink (May 03)

K. A. Steensma

Re: Lost in the config file K. A. Steensma (Jun 27)
Re: Snort / SnortSnarf question about packet capture filenames K. A. Steensma (Jun 26)
Lost in the config file K. A. Steensma (Jun 26)
Re: Lost in the config file K. A. Steensma (Jun 26)

Keith Pachulski

RE: logging to remote syslog Keith Pachulski (May 23)
RE: any snort group in new jersey Keith Pachulski (Apr 29)

Kenny D

Re: DOS MSDTC attempt Kenny D (Apr 17)
Re: DOS MSDTC attempt false positive Kenny D (May 08)
DOS MSDTC attempt false positive Kenny D (May 08)
Acid Fatal error Kenny D (Apr 19)
Placement of Snort IDS Kenny D (Apr 10)
Placement of Snort IDS Kenny D (Apr 14)
How to configure Logwatch Kenny D (May 20)
DOS MSDTC attempt Kenny D (Apr 17)
Where can i get Swatch? Kenny D (May 15)
snort redhat 7.2 server and mysql Kenny D (Apr 14)

Ken Schweigert

Re: Snort + OpenBSD3.0 "Easy" Questions [Solved] Ken Schweigert (Apr 19)
Snort + OpenBSD3.0 "Easy" Questions Ken Schweigert (Apr 17)

Kent Hundley

RE: Cisco PIX firwalls.. Kent Hundley (Apr 14)

Kevin L Pawloski

How much can snort Snort? Kevin L Pawloski (Apr 15)
Re: Two content variables Kevin L Pawloski (Apr 05)
spp_portscan to ignore a port? Kevin L Pawloski (Jun 19)
Re: SNORT GUI Kevin L Pawloski (Jun 27)
Catbird sets off alerts Kevin L Pawloski (Apr 03)
Two content variables Kevin L Pawloski (Apr 05)
Best Way To Handle New Rules Kevin L Pawloski (Apr 12)

Kevin Riggins

Re: Where are portscans stored ? Kevin Riggins (Jun 20)
Looking for tool to generate isp/domain notification emails.... Kevin Riggins (May 10)

kg

Out of the office kg (Jun 23)

Kistler Ueli

Snort IDScenter 1.09 beta 2 is out Kistler Ueli (Jun 21)
IDScenter 1.09 beta 2 released -- New features like Snort configuration wizard, MySQL alert detection, etc.. Kistler Ueli (Jun 22)
Re: Snort installation Kistler Ueli (Jun 28)
Re: SNORT GUI Kistler Ueli (Jun 27)

Kjetil Laasby

RE: SNMP EXCLUDE Kjetil Laasby (Apr 05)
RE: Anyone recognize this packet? Kjetil Laasby (Apr 03)

Konstantinos Papadakis

Red Hat's 2.4.2 Kernel version compatibility Konstantinos Papadakis (Apr 17)

Kreimendahl, Chad J

missing includes in large number of files Kreimendahl, Chad J (Apr 04)
RE: Hotmail Kreimendahl, Chad J (Jun 19)
RE: Proper Method and/or Place to Declare HTTP_SERV ERS port? Kreimendahl, Chad J (May 09)
RE: how to upgrade to schema 105? Kreimendahl, Chad J (Apr 02)
RE: Bandwidth Information Kreimendahl, Chad J (May 29)
RE: RE: snort performance Kreimendahl, Chad J (Apr 18)
RE: Snort rules update Kreimendahl, Chad J (Apr 03)

krista l merrill

Other Snort rulesets? krista l merrill (Apr 09)
Snort/ACID Database Cleanup krista l merrill (Apr 12)
Filesize limit exceeded krista l merrill (Apr 30)
ACID Database Cleanup (data.MYD) krista l merrill (Apr 29)
Re: what does this mean krista l merrill (Apr 05)

Kristopher Czachor

RE: port lists for 1.8 Kristopher Czachor (Jun 27)
ACID enhancement Kristopher Czachor (Jun 06)
RE: 1.8.6 RPMS?? Kristopher Czachor (May 30)
1.8.6 RPMS?? Kristopher Czachor (May 24)
Stoopid port syntax question Kristopher Czachor (Jun 26)
RE: Stoopid port syntax question Kristopher Czachor (Jun 27)

Krzysztof Zaraska

Re: Snort & Prelude Krzysztof Zaraska (Jun 02)

K.S.NARAYANAN

A tool to Archive & delete mysql ( snortdb ) records .. K.S.NARAYANAN (Jun 03)
RE: [Snorting 2 NICs] K.S.NARAYANAN (Jun 11)
RE: [Snorting 2 NICs] K.S.NARAYANAN (Jun 10)
RE: SMTP Virus Gateway K.S.NARAYANAN (Jun 16)

kukulkan

daemon consuming 100% memory kukulkan (May 12)

KyleGinney

Lost ACID database queries KyleGinney (Jun 28)

lakshmi ramachandran

snort does not log data lakshmi ramachandran (Mar 31)

LAMI, Gilles - DSIA

Réf. : Re: [Snort-users] snort 1.8.6 and AIX 4.3.3 LAMI, Gilles - DSIA (Jun 20)

Lance Barisdale

help Lance Barisdale (May 30)

Lance Spitzner

-B option Lance Spitzner (May 18)

Larc

Re: RE: BO pre-processor Larc (Jun 18)
Re: SNORT GUI Larc (Jun 27)

larosa, vjay

RE: Snort SNMP Variables are not consistent? larosa, vjay (May 01)
RE: Snot based attacks and the -z est option. larosa, vjay (Apr 26)
RE: Snort loading at startup larosa, vjay (May 14)
RE: Snot based attacks and the -z est option. larosa, vjay (Apr 26)
RE: BO pre-processor larosa, vjay (Jun 18)
RE: Snot based attacks and the -z est option. larosa, vjay (Apr 26)
FW: Snot based attacks and the -z est option. larosa, vjay (Apr 25)
sneeze.pl larosa, vjay (May 10)
Rules ordering question. larosa, vjay (Apr 30)
RE: Snot based attacks and the -z est option. larosa, vjay (Apr 25)
Snot based attacks and the -z est option. larosa, vjay (Apr 24)
RE: proper usage of $SHELLCODE_PORTS ? larosa, vjay (Apr 22)
RE: Future features??? larosa, vjay (May 12)
RE: [Snort-sigs] SQLsnake - any able to create a sig for this one ? larosa, vjay (May 21)
BO pre-processor larosa, vjay (Jun 18)
RE: Snort loading at startup larosa, vjay (May 14)
RE: demarc: validate larosa, vjay (May 15)
riddle me this.... larosa, vjay (May 09)
Snort and 802.1Q larosa, vjay (Jun 12)
Specifying SNMP Traps. larosa, vjay (May 06)
RE: Upgrading DB schema larosa, vjay (May 15)
Tap -> Hub Problem. larosa, vjay (May 06)
Linux parameters larosa, vjay (Apr 10)
RE: Snort & multi-port ethernet cards larosa, vjay (Jun 20)
RE: Snort getting overloaded by http traffic: larosa, vjay (Jun 26)
RE: RE: BO pre-processor larosa, vjay (Jun 18)
RE: Tap -> Hub Problem. larosa, vjay (May 06)
RE: Snort, Stream4 State and Ethernet Taps. larosa, vjay (May 01)
RE: Question about Demarc larosa, vjay (Apr 19)
RE: proper usage of $SHELLCODE_PORTS ? larosa, vjay (Apr 21)
RE: Snort.conf question $HOME_NET Question V1.8.6 larosa, vjay (May 14)
RE: Tap -> Hub Problem. larosa, vjay (May 06)
Snort, Stream4 State and Ethernet Taps. larosa, vjay (Apr 30)

LaRose, Dallas

RE: Problems logging to syslog and mysql simultaneo usly LaRose, Dallas (Jun 20)
RE: Problems logging to syslog and mysql simultaneo usly LaRose, Dallas (Jun 26)
RE: Problems logging to syslog and mysql simultaneo usly LaRose, Dallas (Jun 26)

Larry Taylor

Acid MySQL problem Larry Taylor (Jun 20)

Laurent Cabal

Some questions about snort Laurent Cabal (Apr 05)
Disable spoofing ARP in kill packets Laurent Cabal (Apr 05)
Snort signatures Laurent Cabal (Apr 26)
Commercial version of Snort Laurent Cabal (Apr 26)

laurent didier

Mandrake 8.2 laurent didier (May 26)

Leandro A Ferreira

Remote GUI Leandro A Ferreira (May 03)
SNMP Problems Leandro A Ferreira (May 02)
Tivoli traps Leandro A Ferreira (May 13)

Lee, Mike (BlackBoard Support)

Network traffic forwarder (hardware device) Lee, Mike (BlackBoard Support) (Jun 28)

Leigh David Heyman

Re: switch Leigh David Heyman (May 15)
Re: gigabit ids Leigh David Heyman (Apr 24)

Leonardo Alcantara Moreira

Re: Red Hat's 2.4.2 Kernel version compatibility Leonardo Alcantara Moreira (Apr 29)
Re: Snort IGNORES var HOME_NET Leonardo Alcantara Moreira (May 03)

Lepchenske, Craig L (Raytheon)

List of explanations for methods? Lepchenske, Craig L (Raytheon) (Apr 23)

limbo

Re:Snort & Cisco Catalyst ISL limbo (May 09)

Lists

Using Snort for Wireless Lists (Apr 03)

lisuke

Re: Snort-users digest, Vol 1 #1789 - 8 msgs lisuke (Apr 13)

Lookman Fazal

writing to log file and running a script at once??? Lookman Fazal (Apr 22)
running a script when a match is found Lookman Fazal (May 07)

Lou Spironello

Snort 1.8.6 RPMS? Lou Spironello (Apr 09)
Re: Snort 1.8.6 RPMS? Lou Spironello (Apr 11)
Re: Snort 1.8.6 RPMS? Lou Spironello (Apr 09)

lpj0508

acceptable packet drop rate for snort lpj0508 (Apr 14)

Luca Tampieri

snort & db with a low speed connection Luca Tampieri (May 14)

Lyle Sudin

configure snort to drop payloads Lyle Sudin (Apr 14)
Re: configure snort to drop payloads Lyle Sudin (Apr 17)
Re: configure snort to drop payloads Lyle Sudin (Apr 16)

Maarten

acid alert group Maarten (Jun 11)

Madhav Diwan

Time Activated Rules Madhav Diwan (Apr 01)

Madziarczyk, Jonathan

RE: WinPcap 2.3 and Win2k Madziarczyk, Jonathan (Jun 18)
RE: WinPcap 2.3 and Win2k Madziarczyk, Jonathan (Jun 18)
OT E-mail Viruses Madziarczyk, Jonathan (Jun 14)
RE: Logging to Remote syslog server Madziarczyk, Jonathan (Mar 31)
WinPcap 2.3 and Win2k Madziarczyk, Jonathan (Jun 17)
More WinPcap 2.3 and Win2k Madziarczyk, Jonathan (Jun 18)

Magnus

Re: log ftp servers in our network Magnus (Apr 14)

Magnus.M.Glantz

SV: Snort doesnt detect traffic. Magnus.M.Glantz (May 30)
SV: SV: Snort doesnt detect traffic. Magnus.M.Glantz (May 31)
Snort doesnt detect traffic. Magnus.M.Glantz (May 29)

mailinglists

Bad Priority Error mailinglists (May 11)

Manuel Pompeia Santos

Re: Demarc Manuel Pompeia Santos (May 02)
SSH scans Manuel Pompeia Santos (Apr 16)
Re: snort & mysql Manuel Pompeia Santos (Apr 13)

Marcel Hauser

Re: TCP ******S* portscan "SOLVED" Marcel Hauser (Apr 06)
TCP ******S* portscan Marcel Hauser (Apr 05)
RE: TCP ******S* portscan Marcel Hauser (Apr 05)

Marcello Mezzanotti

snort current doesnt run Marcello Mezzanotti (Apr 03)

Marco Thorbruegge

Re: fragroute vs. snort: the tempest in a teacup Marco Thorbruegge (Apr 19)

Mark Horn

Detecting tunnels? Mark Horn (May 03)
Re: Detecting tunnels? Mark Horn (May 05)

Mark Palmer, CCNA

unsubscribe Mark Palmer, CCNA (Jun 29)

Mark Rowlands

Re: make error in snort-current spo_SnmpTrap.@OBJEXT@ Mark Rowlands (Apr 19)
Re: Pretty Reports for Management Mark Rowlands (May 31)
cannot compile snort on Freebsd 4.5 or 4.6 from cvs.....snort 1.8.6 compiles ok Mark Rowlands (May 28)
Re: Snort/ACID Database Cleanup Mark Rowlands (Apr 19)
make error in snort-current spo_SnmpTrap.@OBJEXT@ Mark Rowlands (Apr 19)
Re: Snort/ACID Database Cleanup Mark Rowlands (Apr 19)

Markt

unsubscribe Markt (Jun 03)

Mark Vevers

Patch for Time criteria handling in ACID Mark Vevers (Jun 13)
Patch for Time criteria handling in ACID Mark Vevers (Jun 12)
Rman - 0.0.4 Alpha is out Mark Vevers (Jun 27)
Patch for bug in Acid criteria removal Mark Vevers (Apr 10)

Mark Wormgoor

Re: 1.8.6 RPMS?? Mark Wormgoor (May 30)

Marnix Petrarca

Re: Testing tools Marnix Petrarca (Jun 16)
Re: Testing tools Marnix Petrarca (Jun 16)
Re: WinPcap 2.3 and Win2k Marnix Petrarca (Jun 18)

Martin Claesson

unsubscribe Martin Claesson (Apr 23)

Martin C. Walker

Snort, Acid, BigBrother Martin C. Walker (Apr 02)

Martin Forest

Odd question... Martin Forest (Apr 30)
REMOVE Jason Haar from the list! Martin Forest (May 07)
snort-users mailinglist trigger snort Martin Forest (Apr 25)
Re: Tivoli traps Martin Forest (May 13)
Re: Strange mail problem Martin Forest (May 21)
Re: [Snorting 2 NICs] Martin Forest (Jun 13)
Re: cmd.exe Martin Forest (Apr 29)
Strange mail problem Martin Forest (May 21)
[Fwd: Re: REMOVE Jason Haar from the list!] Martin Forest (May 07)
Re: blocking Martin Forest (May 16)

Martin Roesch

Re: ACTION: Snort user's group in NOVA ? Martin Roesch (Apr 29)
Re: proper usage of $SHELLCODE_PORTS ? Martin Roesch (Apr 22)
Re: Price for "vanilla Snort" (no bells and whistles) Martin Roesch (May 07)
Re: Session data, alerts, and barnyard Martin Roesch (Jun 11)
Re: Real Time Alert sensor Martin Roesch (Jun 23)
Re: snort 1.8.6 and AIX 4.3.3 Martin Roesch (Jun 23)
Re: Price for "vanilla Snort" (no bells and whistles) Martin Roesch (May 08)
Re: fragroute related fixes need testing on real networks Martin Roesch (Apr 22)

MASM

Resp/React Firing Problem/Bug MASM (Jun 18)

Math

Ignore ICMP ping Math (May 31)
snort email alert Math (May 23)

matt

Re: Which rules to use for snort ? matt (Jun 03)
RE: SMTP Virus Gateway matt (Jun 14)
Re: Stable Snort Rules fails? matt (Jun 01)
Re: My Webservers Are Showing Up In My Alerts matt (Jun 13)
Re: shellcode error matt (May 30)
Re: Email alert and porscan.log on a daily basis matt (Jun 01)
Re: Exploit? (RCPT overflow) matt (Jun 13)
Re: snort 1.9.x would not compile on FreeBSD 4.5 (snapshot build?) matt (Jun 04)
Re: Preprocessors matt (Jun 03)
Re: Configuration HELP! (understanding alerts and proxies) matt (Jun 12)
Re: My Webservers Are Showing Up In My Alerts matt (Jun 13)
Re: I'd rather not get the message matt (Jun 03)
Re: Detecting concurrent connections matt (Jun 12)
Re: Multiple IP matt (Jun 01)

Matt Furminger

NO UDP visibility Matt Furminger (Apr 29)

Matthew J. Vinton

Snort XML Report Generation Matthew J. Vinton (Apr 19)

Matt Kettler

Re: ICMP Destination Unreachable Matt Kettler (Apr 09)
Re: snort email alert Matt Kettler (May 23)
RE: Snort rules touble. Matt Kettler (Jun 21)
Re: (no subject) Matt Kettler (Apr 09)
Re: shellcode error Matt Kettler (May 31)
Re: OT: Deciphering log entry(iptables) Matt Kettler (Apr 02)
Re: : Configuration HELP! (understanding alerts and proxies) Matt Kettler (Jun 12)
Re: (no subject) Matt Kettler (May 04)
Re: False positives with SMTP RCPT TO overflow rule Matt Kettler (Jun 27)
Re: modprobe error in log... Matt Kettler (May 11)
Re: daemon consuming 100% memory Matt Kettler (May 13)
Re: need your help Matt Kettler (Apr 15)
Re: snort and slackware..(logging question) Matt Kettler (Jun 27)
Re: False positives with SMTP RCPT TO overflow rule Matt Kettler (Jun 25)
Re: SQLsnake - any able to create a sig for this one? Matt Kettler (May 22)
Re: Multiple IP (ethernet switches vs hubs) Matt Kettler (Jun 03)
Re: Too many events in logs Matt Kettler (May 23)
Re: is this a bad traffic? Matt Kettler (Apr 10)
Re: DOS MSDTC attempt false positive Matt Kettler (May 08)
Re: TCP ******S* portscan Matt Kettler (Apr 05)
Re: ADdRules Matt Kettler (May 12)
Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Matt Kettler (May 08)
Re: Syslog output other file Matt Kettler (Apr 19)
RE: monitoring https / SSL Matt Kettler (May 02)
Re: Shellcode.rules fatal error? Matt Kettler (May 12)
Re: String matching in snort. Matt Kettler (May 12)
Re: Current Rule Set Matt Kettler (Jun 10)
Re: SYN flood detection Matt Kettler (May 10)
Re: My Webservers Are Showing Up In My Alerts Matt Kettler (Jun 13)
RE: Snort getting overloaded by http traffic: Matt Kettler (Jun 25)
Re: REMOVE Jason Haar from the list! Matt Kettler (May 07)
OT: RE: what does this mean Matt Kettler (Apr 05)
RE: Snorting the MAC address Matt Kettler (Apr 11)
Re: SNMP Problems Matt Kettler (May 02)
Re: [spp_portscan] Matt Kettler (Jun 20)
Re: Bad Priority Error Matt Kettler (May 11)
Re: NO UDP visibility Matt Kettler (Apr 29)
Re: TCP ******S* portscan Matt Kettler (Apr 05)
Re: Output question during FIN scan Matt Kettler (May 12)
Re: Snort IGNORES var HOME_NET Matt Kettler (May 08)
Re: snort rule question.. Matt Kettler (May 02)
Re: DOS MSDTC attempt false positive Matt Kettler (May 11)
Re: question about finding out about traffic Matt Kettler (Apr 26)
Re: Multiple Content (not working?) Matt Kettler (May 15)
Re: Snort rules touble. Matt Kettler (Jun 21)
Re: SMTP rule needed Matt Kettler (Apr 09)
Re: Snort IGNORES var HOME_NET Matt Kettler (May 03)
Re: where can i find out the meaning (stealth nop) Matt Kettler (Apr 09)
Re: not logging portscans Matt Kettler (May 23)
Re: Snort output Matt Kettler (May 10)
Re: [Snort-sigs] RESP not working in rules Matt Kettler (Apr 20)
Re: DOS MSDTC attempt false positive Matt Kettler (May 11)
Re: Snort signatures Matt Kettler (Apr 26)

Matt Richter

Snort Database and ODBC Clients Matt Richter (May 31)
Not Compiled for MySQL Matt Richter (May 25)

Matt Watchinski

Re: How To Decode IPv6 Packet? Matt Watchinski (Apr 02)

Matt Yackley

Snort / SnortSnarf question about packet capture filenames Matt Yackley (Jun 26)
RE: Snort / SnortSnarf question about packet captur e filenames Matt Yackley (Jun 26)
RE: Snort / SnortSnarf question about packet captur e filenames Matt Yackley (Jun 26)
RE: Snort in a switched environment Matt Yackley (May 14)
RE: Curse of the cmd.exe Matt Yackley (Jun 14)
RE: Snort / SnortSnarf question about packet captur e filenames - FIXED Matt Yackley (Jun 26)

max valdez

Snort not loggin max valdez (Jun 24)

M. Burnett

RE: Curse of the cmd.exe M. Burnett (Jun 17)

McCammon, Keith

RE: SNORT newbie looking for some help with Snort on Win2k McCammon, Keith (May 15)
RE: Snort Topology Configuration McCammon, Keith (Jun 24)
RE: not logging portscans McCammon, Keith (May 23)
RE: Ignore multiple hosts with command line arguments McCammon, Keith (Jun 03)
RE: OT: IP Blocks by country/region? McCammon, Keith (Jun 13)
RE: Win32 Port of Snort McCammon, Keith (May 20)
FW: [Snorting 2 NICs] McCammon, Keith (Jun 10)
ACTION: Snort user's group in NOVA ? McCammon, Keith (Apr 26)
RE: Setting up a Windowz Interface to monitor with no IP Address McCammon, Keith (Jun 28)
RE: I'd rather not get the message McCammon, Keith (Jun 03)
RE: As a newbie, two questions McCammon, Keith (May 03)
RE: Snort comparisons McCammon, Keith (May 20)
RE: snort exit McCammon, Keith (May 16)
RE: Snort & multi-port ethernet cards McCammon, Keith (Jun 20)
RE: [Snorting 2 NICs] McCammon, Keith (Jun 10)
RE: Setting up a Windowz Interface to monitor with no IP Address McCammon, Keith (Jun 28)
RE: newbie - excluding an IP Address McCammon, Keith (Jun 13)
RE: STEALTH ACTIVITY (NULL scan) ??? McCammon, Keith (Apr 24)
RE: Where can i get Swatch? McCammon, Keith (May 15)
RE: Snort user's group in NOVA ? McCammon, Keith (Apr 26)
RE: -i any ? McCammon, Keith (May 14)
RE: what does this mean McCammon, Keith (Apr 05)
RE: Network traffic forwarder (hardware device) McCammon, Keith (Jun 28)
RE: Preventing Attacks McCammon, Keith (Jun 26)
RE: (no subject) McCammon, Keith (Jun 04)
RE: Snort getting overloaded by http traffic: McCammon, Keith (Jun 25)
RE: Snort at boot McCammon, Keith (Jun 18)
RE: As a newbie, two questions McCammon, Keith (May 03)
RE: Cron Script McCammon, Keith (May 23)
RE: monitoring https / SSL McCammon, Keith (May 02)
RE: NOVA snort user's group meeting McCammon, Keith (Jun 05)
RE: Current Rule Set McCammon, Keith (Jun 10)
RE: Snort in a switched environment McCammon, Keith (May 14)
RE: *NIX ping alerts McCammon, Keith (Jun 24)
RE: *NIX ping alerts McCammon, Keith (Jun 24)
RE: select rules McCammon, Keith (Jun 13)
RE: List of IP Address McCammon, Keith (Jun 26)
RE: I think I know the answer to this, but not 100% sure McCammon, Keith (Jun 26)
RE: private IP scans McCammon, Keith (Apr 08)
RE: Setting up a Windowz Interface to monitor with no IP Address McCammon, Keith (Jun 28)
RE: Best snort list replier / contributor McCammon, Keith (Apr 15)
RE: SMTP Virus Gateway McCammon, Keith (Jun 14)

McClure Gammon

RE: modprobe error in log... McClure Gammon (May 13)

McConnon, John

Snort and MS SQL reporting McConnon, John (Apr 02)

McGuire, Barrett

RE: snort configuration using gui... McGuire, Barrett (May 20)

McKim, Tim

Changing the filename format for alerts McKim, Tim (Jun 14)
Ignore multiple hosts with command line arguments McKim, Tim (Jun 03)
Applolgy for the HTML email- Snort Filename format McKim, Tim (Jun 14)

'mel'

Re: snort on IP-less interface 'mel' (Apr 10)

mel

(ot) how to get alert size? mel (May 28)
snort on IP-less interface mel (Apr 09)

Metz, Tim

RE: defining $external_net Metz, Tim (Apr 25)
defining $external_net Metz, Tim (Apr 25)
RE: Snort SNMP Variables are not consistent? Metz, Tim (May 01)

Michael Anderson

barnyard over TCP Michael Anderson (May 30)
Re: pid file, how do I create one? Michael Anderson (Apr 30)
Re: barnyard over TCP Michael Anderson (May 30)
port 135 scans Michael Anderson (Apr 23)

Michael Aylor

RE: ACID Database Cleanup (data.MYD) Michael Aylor (Apr 29)

Michael Boman

Re: Excluding $HOME_NET -> $HOME_NET Alerts Michael Boman (May 20)
Re: Excluding $HOME_NET -> $HOME_NET Alerts Michael Boman (May 19)
Re: Lost in the config file Michael Boman (Jun 27)
Re: Excluding $HOME_NET -> $HOME_NET Alerts Michael Boman (May 19)
Re: running a script when a match is found Michael Boman (May 07)

Michael Brown

RE: Exploit? Michael Brown (Jun 17)

Michael Cunningham

Gigabit snort? Michael Cunningham (Apr 10)

Michael Gargiullo

FYI - Possible cause for false positive - ICMP L3retriever Ping Michael Gargiullo (Jun 12)
Re: Mysql problem Michael Gargiullo (Jun 23)

Michael J Worden

Win32 Port of Snort Michael J Worden (May 20)
Practical Limits on Snort/MySQL? Michael J Worden (Jun 09)

Michael Northup

Exploit? Michael Northup (Jun 13)

Michael S. Boyd

ACID help Michael S. Boyd (May 23)
RE: ACID help Michael S. Boyd (May 23)

Michael Scheidell

snort 1.87beta5 still holds some fds on HUP Michael Scheidell (May 28)
snortpp missing? Michael Scheidell (May 27)
barnyard-0.1.0-beta5 and mysql Michael Scheidell (May 27)
barnyard problem dotted quad backwards or corrupted? Michael Scheidell (Apr 14)
use of BPF in 1.8.7beta6 might be broken Michael Scheidell (Jun 09)
Re: cmd.exe Michael Scheidell (Apr 29)
Re: How to Craft a rule that negates multiple ports?? Michael Scheidell (May 29)
barnyard alert_fast not compatible with snort -A fast? Michael Scheidell (May 01)
how to upgrade to schema 105? Michael Scheidell (Apr 02)
Re: Fine-tuning a rule Michael Scheidell (May 17)
Re: snortconf via web Michael Scheidell (May 05)
Re: Portscans from China ? Michael Scheidell (Apr 15)
Re: acid question Michael Scheidell (Apr 02)
Re: ACID enhancement Michael Scheidell (Jun 07)
will barnyard output full detail for alert? Michael Scheidell (Apr 14)
barnyard status? Michael Scheidell (May 19)
some policy rules missing in 1.8.7 beta5? Michael Scheidell (May 31)
patch to reference.config? Michael Scheidell (May 19)
Re: snort 1.87beta5 still holds some fds on HUP(fixed) Michael Scheidell (Jun 01)
Re: Unified Alert Output and IP Reversal Michael Scheidell (Apr 15)
barnyard ignores msg text on custom rules? Michael Scheidell (Apr 27)

Michael Steele

Attenion Windows Users: Latest Snort 1.86 RELEASE Binaries available Michael Steele (Apr 11)
RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 19)
RE: newbie snort user on windows xp needs help please Michael Steele (Jun 26)
RE: More WinPcap 2.3 and Win2k Michael Steele (Jun 18)
RE: configuring snort 1.8.x on windows 2000 pro.. Michael Steele (May 04)
RE: Setting up a Windowz Interface to monitor with no IP Address Michael Steele (Jun 27)
RE: Problem emailing alerts from ACID Michael Steele (Jun 17)
RE: Win32 Port of Snort Michael Steele (May 20)
RE: Running 2 instances of snort Michael Steele (Jun 14)
RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 19)
RE: Snort Interfaces problem (Win32) Michael Steele (Jun 24)
RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 19)
RE: SNORT newbie looking for some help with Snort on Win2k Michael Steele (May 16)
RE: Snort Interfaces problem (Win32) Michael Steele (Jun 24)
RE: Problems logging to syslog and mysqlsimultaneously Michael Steele (Jun 21)
RE: Setting up Snort on Windows Michael Steele (Jun 27)
RE: Running 2 instances of snort Michael Steele (Jun 15)
RE: Installing Snort on Win 2K Michael Steele (Jun 17)
RE: Remote Syslog Michael Steele (May 09)
FW: FW: ERROR: OpenPcap Michael Steele (Jun 19)
RE: Snort Questions Michael Steele (Jun 20)
FW: ERROR: OpenPcap Michael Steele (Jun 19)
RE: Syslog on W2K Michael Steele (Jun 12)
RE: Snort Interfaces problem (Win32) Michael Steele (Jun 24)
RE: New Install Michael Steele (Jun 19)
FW: FW: ERROR: OpenPcap Michael Steele (Jun 19)
RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 20)
RE: WinPcap 2.3 and Win2k Michael Steele (Jun 17)
RE: A couple more questions Michael Steele (Jun 24)
Attention: Win32 Users - Snort 1.8.6b121 Ready - W/Run As Service Michael Steele (May 30)
RE: Compiling snort on Win32 Michael Steele (May 31)
RE: Snort on Acid instructions Michael Steele (Jun 14)
RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 19)
RE: Installing Snort on Win 2K Michael Steele (Jun 17)
RE: New Install Michael Steele (Jun 19)
RE: Snort Install--Win2K Michael Steele (Apr 08)
Attention WINDOWS Users! Latest Snort 1.87b119 Binaries Available NOW! Michael Steele (May 15)
Attention WINDOWS Users: Latest 1.87b119 Binaries Available Michael Steele (May 16)
RE: Snort Michael Steele (Jun 21)
RE: Snort ---> syslog Michael Steele (Jun 21)
RE: Snort on Windows 2000 Server platform. Michael Steele (Apr 18)
RE: Problems logging to syslog and mysql simultaneously Michael Steele (Jun 19)
RE: RE: Snort on Acid instructions Michael Steele (Jun 15)
RE: Setting up a Windowz Interface to monitor with no IP Address Michael Steele (Jun 28)
Attention Windows Users: Latest Snort 1.87b113 Binaries available - Fixed WinPcap Error Michael Steele (May 02)
RE: RE: Snort Michael Steele (Jun 21)
RE: newbie snort user on windows xp needs help please Michael Steele (Jun 26)
RE: Snort ---> syslog Michael Steele (Jun 21)

Micha Silver

tcpdump format Micha Silver (Apr 14)

Mikael Chambon

spp_portscan and mysql Mikael Chambon (May 12)
Re: spp_portscan and mysql Mikael Chambon (May 13)

Mikael Fantaye

Snort Users Group IN San Francisco Bay ? Mikael Fantaye (Apr 25)

mike

Q-ICMP rule/IDS202 mike (Apr 25)

Mike Ahern

Advice on the Network Infrastructure Side of IDS Design... Mike Ahern (Apr 25)
Snort 99% cpu utilization and no process activity Mike Ahern (Apr 05)
Snort 99% cpu utilization and no process activity Mike Ahern (Apr 14)

Mike Arrison

RE: RV: Snort exploits Mike Arrison (Apr 17)
RE: Portscans from China ? Mike Arrison (Apr 14)
RE: mysql schema & multiple snort versions & sensors Mike Arrison (Apr 04)

Mike Craik

Re: Using Snort for Wireless Mike Craik (Apr 03)
Re: Using Snort for Wireless Mike Craik (Apr 04)

Mike Macias

Signature names Mike Macias (Apr 23)
Re: Portscan not logging Mike Macias (May 28)
Re: Rules Errors Mike Macias (Apr 03)
Re: Snort DB configuration Mike Macias (May 02)

mike maxwell

Re: Commercial version of Snort mike maxwell (Apr 26)
newbie question mike maxwell (Apr 10)
acid mike maxwell (Apr 15)

Mike Meredith

Alpha4 Accounty Mike Meredith (May 29)

Mike_Sands

Re: problem logging to mysql database Mike_Sands (Apr 02)
Re: IDS Policy Manager 1.2 Release Mike_Sands (Apr 01)
stop that pesky logging Mike_Sands (Apr 01)
Re: I think I know the answer to this, but not 100% sure Mike_Sands (Jun 26)

Mike Sapsara

correlating alerts with action required Mike Sapsara (Apr 26)

Mike Shaw

Schema from 1.83 to 1.86 Mike Shaw (May 14)
RE: Setting up a Windowz Interface to monitor with no IP Address Mike Shaw (Jun 28)
Re: Snort Questions Mike Shaw (Jun 20)
p2p bird-dog rules Mike Shaw (Apr 24)

Mikhail Koulechov

Snort on Windows 2000 Server platform. Mikhail Koulechov (Apr 18)

Milan Kubala

IDS and traffic monitor in one Milan Kubala (Jun 18)

Mipam

Re: include problem in 1.8.6 Mipam (Apr 11)
include problem in 1.8.6 Mipam (Apr 10)
Re: How much can snort Snort? Mipam (Apr 15)
Re: include problem in 1.8.6 Mipam (Apr 10)

Mitchell Henderson

Wireless monitoring Mitchell Henderson (May 22)

mnichols

snort wont log to mysql database mnichols (Apr 28)

MOHESOWA BYAS

Snort DB configuration MOHESOWA BYAS (May 02)
RE: snortrules.tar.gz MOHESOWA BYAS (May 15)

MOLLOY, Brendan, GCM

RE: Curse of the cmd.exe MOLLOY, Brendan, GCM (Jun 17)

mostafa rrrrrr

snort rules mostafa rrrrrr (May 27)
ACID mostafa rrrrrr (Jun 01)

Moyer, Shawn

Managing large IDS deployments (SecurityFocus) Moyer, Shawn (May 18)

Mr. F Phat's

alert Mr. F Phat's (May 29)
snortconf via web Mr. F Phat's (May 01)
SNORT rule Mr. F Phat's (May 27)

M. Toren

Barnyard dumps core when using acid_log (but not acid_alert) M. Toren (May 22)

Muhammad Faisal Rauf Danka

Re: My Webservers Are Showing Up In My Alerts Muhammad Faisal Rauf Danka (Jun 13)
Re: port 22 scan Muhammad Faisal Rauf Danka (Jun 04)

nanthan

Alert File in Snort & SnortSnarf nanthan (Apr 24)
Re: Snort-users -- confirmation of subscription -- request 370109 Nanthan (Apr 24)
confirm 370109 Nanthan (Apr 24)
SnortSnarf Compile error nanthan (Apr 21)

Naor

RE: Snort on WinXP: driver problem Naor (Apr 02)

nate

SPADE alerts, but doesn't log nate (Apr 14)

Nate Haggard

Snorting the MAC address Nate Haggard (Apr 11)

Nate S.

SPADE alerts, but doesn't log Nate S. (Apr 03)
Re: acid on RH7.2 Nate S. (Apr 11)

Nels Lindquist

RE: False positives with SMTP RCPT TO overflow rule Nels Lindquist (Jun 25)
False positives with SMTP RCPT TO overflow rule Nels Lindquist (Jun 25)
Re: False positives with SMTP RCPT TO overflow rule Nels Lindquist (Jun 27)

Nguyen Thai Ha

Network Adapter failed with snort ! Nguyen Thai Ha (Apr 15)

Nick Petroni

Re: Using Snort for Wireless Nick Petroni (Apr 04)

Nick Zitzmann

[ANN] MacNIDS Nick Zitzmann (May 21)
Unix sockets Nick Zitzmann (Jun 01)
[ANN] HenWen 1.0.2 for Snort Nick Zitzmann (Jun 26)
[ANN] HenWen 1.0 for Snort Nick Zitzmann (Jun 13)

Nils Michaelsen

<no subject> Nils Michaelsen (Apr 23)
snort 1.8.6 tarball on Red Hat 7.2 Nils Michaelsen (Apr 23)

nitewalker

Mandrake 8.0 nitewalker (Apr 22)

Noller, Gregory

Snort and MySQL ./configure problems Noller, Gregory (Apr 16)
Demarc (PureSecure) Noller, Gregory (May 03)
Which version should I use? 1.8.3 .4 .5 or .6 Noller, Gregory (Apr 16)

noorulsadiqin azbiya

configuring snort 1.8.x on windows 2000 pro.. noorulsadiqin azbiya (May 04)
packet generator noorulsadiqin azbiya (May 04)
configuration error the 1st time running acid (asap) noorulsadiqin azbiya (May 12)
need help asap noorulsadiqin azbiya (Apr 10)
need your help noorulsadiqin azbiya (Apr 13)

O'Brien, James

Blocking individual IP's O'Brien, James (Apr 11)

Oliver Friesen

simple mistake in icmp payload calculation Oliver Friesen (Apr 20)

Omolayo Salako

RE: msql error Omolayo Salako (Apr 29)
RE: writing to log file and running a script at onc e??? Omolayo Salako (Apr 22)
barnyard and demarc question Omolayo Salako (May 01)
RE: Demarc (PureSecure) Omolayo Salako (May 06)
any snort group in new jersey Omolayo Salako (Apr 29)
barnyard question? Omolayo Salako (May 08)
what does this mean Omolayo Salako (Apr 05)
RE: Blocking individual IP's Omolayo Salako (Apr 11)
msql error Omolayo Salako (Apr 29)
problem logging to mysql database Omolayo Salako (Apr 02)
weird behaviour with Puresecure Omolayo Salako (May 06)
RE: (no subject) Omolayo Salako (Apr 10)
shell code detect Omolayo Salako (Apr 11)
mysql config error Omolayo Salako (Jun 03)
bpf filter Omolayo Salako (Jun 03)
RE: snort and puresecure problem Omolayo Salako (Jun 26)
snort and puresecure problem Omolayo Salako (Jun 24)

Onie Camara

Re: SNMP EXCLUDE Onie Camara (Apr 05)
maxsize of mysql db? Onie Camara (Apr 04)
Is this a valid traffic? Onie Camara (Apr 03)
Re: what is good Onie Camara (Apr 21)
what is good Onie Camara (Apr 21)
Re: what would be the appropriate thing to do? Onie Camara (Apr 04)
what would be the effect? Onie Camara (Apr 05)
Re: KLEZ Onie Camara (Apr 25)
Re: Snort+flexresp Onie Camara (Apr 02)
Re: Snort+flexresp Onie Camara (Apr 02)
Re: 1.8.5 ? Onie Camara (Apr 03)
Re: what does this mean Onie Camara (Apr 05)
Re: what would be the appropriate thing to do? Onie Camara (Apr 04)
what would be the appropriate thing to do? Onie Camara (Apr 04)
simple reporter Onie Camara (Apr 10)
what's preferred kernel? Onie Camara (Apr 02)

Parker, Ian

Dr. Watson when Logging in Binary Mode Parker, Ian (Jun 07)

Pathmenanthan Ramakrishna

Alert Method in Snort & SnortSnarf Pathmenanthan Ramakrishna (Apr 24)
Real Time Alert sensor Pathmenanthan Ramakrishna (Jun 21)
DoS Alert in Snort Pathmenanthan Ramakrishna (Jun 17)
Snort External Alert Sensors Pathmenanthan Ramakrishna (Jun 28)

Patrice . Arnal

Connecting snort bidirectionnal. Patrice . Arnal (May 23)

Patrick Harper

Re: whitehats.com is online again Patrick Harper (Apr 05)
Re: Snort install document for peer review. Patrick Harper (Apr 23)
RE: snort configuration using gui... Patrick Harper (May 19)
Re: Newbie question Patrick Harper (Apr 21)
Re: whitehats.com is online again Patrick Harper (Apr 05)

Patrick Lanphier

Active Firewalling Patrick Lanphier (Apr 14)

Patrick McHardy

OT: Common services signatures Patrick McHardy (Jun 13)

Paul . Fiero

Future features??? Paul . Fiero (May 11)

Paul Hem

RE: LaBrea Paul Hem (Jun 07)

Paul J. Smith

Snort not loggin hack attempts Paul J. Smith (Jun 25)
Snort Interfaces problem (Win32) Paul J. Smith (Jun 24)

Paul . Simons

Re: SMTP rule needed Paul . Simons (Apr 09)
ispy software (slightly off-topic) Paul . Simons (May 14)
SMTP rule needed Paul . Simons (Apr 09)
Can I get alerts for IM Paul . Simons (Apr 17)

Paweł Goleń

Snort crashes with binary log Paweł Goleń (May 13)

Pawel Rogocz

Re: Detecting benchmarks Pawel Rogocz (May 10)
What's the fuss about string matching ? Pawel Rogocz (May 27)
Re: SYN flood detection Pawel Rogocz (May 10)
Re: Detecting benchmarks Pawel Rogocz (May 08)
Detecting benchmarks Pawel Rogocz (May 08)
SYN flood detection Pawel Rogocz (May 10)

pbsarnac

Snort user groups pbsarnac (Apr 29)

Peng Yong

BUG of "config bpf_file" Peng Yong (May 01)
Re: BUG of "config bpf_file" Peng Yong (May 01)
bug in spp_http_decode.c Peng Yong (May 14)
BUG in stream4 reassemble Peng Yong (Apr 01)
BUG in stream4 reassemble Peng Yong (Apr 02)
memory allocate error check Peng Yong (Apr 17)
session log Peng Yong (Apr 07)

Peter Bates

Highlighting an IP address in an alert/log Peter Bates (May 21)

Peter Johnson

Re: snort 1.9.x would not compile on FreeBSD 4.5 Peter Johnson (Jun 04)
Re: snort 1.9.x would not compile on FreeBSD 4.5/4.6 (confirm) Peter Johnson (Jun 04)

Peter . VE

snort 1.8.7 and fragroute Peter . VE (Jun 05)

Peter V.E.

Snort 1.8.7 and fragroute Peter V.E. (Jun 24)

Petriz, Pablo

Best snort list replier / contributor Petriz, Pablo (Apr 15)
RV: Snort exploits Petriz, Pablo (Apr 17)
portscan Petriz, Pablo (May 30)
stop HTML post Petriz, Pablo (Apr 04)
RE: RV: portscan Petriz, Pablo (Jun 03)
RV: portscan Petriz, Pablo (May 31)

Petr Ruzicka

Re: [Snorting 2 NICs] Petr Ruzicka (Jun 10)

Phil Lyons

Re: mysql schema & multiple snort versions & sensors Phil Lyons (Apr 03)
mysql schema & multiple snort versions & sensors Phil Lyons (Apr 03)

Phil Wood

Re: EXTERNAL_NET Phil Wood (Jun 22)
Re: How much can snort Snort? Phil Wood (Apr 15)
Re: "Flow" problem Phil Wood (Apr 28)
Apology Phil Wood (May 02)
Re: Stupid question, as in I ought to know the answer to Phil Wood (Jun 25)
Re: Linux parameters Phil Wood (Apr 11)
Re: Ignore multiple hosts with command line argumen ts Phil Wood (Jun 03)
Re: BUG of "config bpf_file" Phil Wood (May 01)
Re: Flexresp Phil Wood (Apr 08)
Re: BUG of "config bpf_file" Phil Wood (May 01)
Re: www.snort.org down? Phil Wood (Apr 17)
Re: Snort Reporting Actual HTTP Destination Phil Wood (Apr 30)
Re: portscsan.log summary. Phil Wood (Jun 01)
I'd rather not get the message Phil Wood (Jun 01)
Re: Snort Working Mechanism Phil Wood (Apr 03)
Re: OT: RE: what does this mean Phil Wood (Apr 05)
Re: Flexresp Phil Wood (Apr 08)
Re: WEB-ATTACKS id command attempt Phil Wood (Apr 15)
Re: SSL CodeRed et al Phil Wood (May 28)
Re: q about alerts Phil Wood (May 31)
Stupid question, as in I ought to know the answer to this. Phil Wood (Jun 25)
Re: HOME_NET question... Phil Wood (Apr 23)
Wondering if any of you have seen the following subject line Phil Wood (Apr 27)
Re: EXTERNAL_NET Phil Wood (Jun 23)
Re: real basic starter rules Phil Wood (Apr 25)

Pierre

Re: ICMP Destination Unreachable (Port Unreachable) Pierre (Apr 14)

piotr . bulczak

Re: log ftp servers in our network piotr . bulczak (Apr 15)
Re: Shellcode.rules fatal error? piotr . bulczak (May 12)
Re: Ignoring all traffic from a certain network piotr . bulczak (Apr 15)
Re: Tivoli traps piotr . bulczak (May 13)

Piotr Bulczak

Re: Snort Implementation Guide - ACID-MySQL-Redhat7.2 Piotr Bulczak (Jun 04)
Re: ACID Problem Piotr Bulczak (May 15)
Re: WEB-ATTACKS id command attempt Piotr Bulczak (Apr 15)
Re: Snort comparisons Piotr Bulczak (May 20)

Poppi, Sandro

AW: spp_portscann don't work Poppi, Sandro (May 24)
AW: What do these errors mean? Poppi, Sandro (May 14)
AW: Ignore ICMP ping Poppi, Sandro (May 31)
AW: snort activating my own script Poppi, Sandro (Apr 03)
AW: another switch question Poppi, Sandro (May 16)
AW: (no subject) Poppi, Sandro (May 30)
AW: Alerts with Snort Poppi, Sandro (May 21)
AW: Price for "vanilla Snort" (no bells and whistle s) Poppi, Sandro (May 06)
AW: Snort and network taps Poppi, Sandro (Apr 23)
AW: Some questions about snort Poppi, Sandro (Apr 05)
AW: Pass rules?? Poppi, Sandro (May 07)
AW: Snort and MySQL ./configure problems Poppi, Sandro (Apr 16)
AW: Snort loading at startup Poppi, Sandro (May 14)
AW: switch Poppi, Sandro (May 15)
AW: (no subject) Poppi, Sandro (Jun 04)
AW: Automating Sensor Installation Poppi, Sandro (May 20)
AW: Snort not Log Poppi, Sandro (May 14)
AW: New to Snort Poppi, Sandro (Apr 03)
AW: mysql.sock - where? Poppi, Sandro (May 07)
AW: Snort & multi-port ethernet cards -- PART II Poppi, Sandro (Jun 22)
AW: Example Script for Snort Poppi, Sandro (Apr 29)
AW: Snort not Log Poppi, Sandro (May 14)
AW: Help with where to place a Snort sensor! -newbi e questions- Poppi, Sandro (Jun 19)
AW: Schema from 1.83 to 1.86 Poppi, Sandro (May 14)
AW: Upgrading DB schema Poppi, Sandro (May 15)
whitehats.com is online again Poppi, Sandro (Apr 05)
AW: need your help Poppi, Sandro (Apr 13)
WG: Demarc Security Update Advisory Poppi, Sandro (Apr 16)
AW: Patrick Mullen's webpage? Poppi, Sandro (Apr 10)
AW: Future features??? Poppi, Sandro (May 12)
AW: [Barnyard-users] NIDS newbie question Poppi, Sandro (May 12)
AW: Snort and Logwatch Poppi, Sandro (Apr 08)
AW: [Snorting 2 NICs] Poppi, Sandro (Jun 10)
AW: Newbie question Poppi, Sandro (Apr 21)
AW: what would be the appropriate thing to do? Poppi, Sandro (Apr 04)
AW: snort on IP-less interface Poppi, Sandro (Apr 09)
AW: what would be the appropriate thing to do? Poppi, Sandro (Apr 04)
AW: [ANN] MacNIDS Poppi, Sandro (May 21)
AW: Cron Script Poppi, Sandro (May 23)
AW: Snort > mysql > acid - timestamp troubles Poppi, Sandro (May 30)
AW: whitehats.com is online again Poppi, Sandro (Apr 05)
AW: external_net and home_net questions Poppi, Sandro (Jun 02)
AW: Snort & multi-port ethernet cards Poppi, Sandro (Jun 20)
AW: what would be the appropriate thing to do? Poppi, Sandro (Apr 04)
AW: alert by email. Poppi, Sandro (May 23)
AW: Connecting snort bidirectionnal. Poppi, Sandro (May 23)
AW: problem logging to mysql database Poppi, Sandro (Apr 02)
AW: Same question again.. Poppi, Sandro (May 30)
AW: [Snorting 2 NICs] Poppi, Sandro (Jun 11)
AW: barnyard over TCP Poppi, Sandro (May 31)
AW: Rules problem on dual nic vpn server... Poppi, Sandro (Jun 23)
AW: Viewing MySql Archive with Acid Poppi, Sandro (May 15)
AW: Bonding - has anyone gotten it to work with an ether tap Poppi, Sandro (May 28)

Potts, Ross A.

RE: cmd.exe Potts, Ross A. (Apr 29)
Snort on Win32 Potts, Ross A. (Jun 03)
RE: Looking for tool to generate isp/domain notific ation emails.... Potts, Ross A. (May 10)
RE: Testing Snort Potts, Ross A. (May 21)
RE: Alert Method in Snort & SnortSnarf Potts, Ross A. (Apr 24)
Snort 1.8.4 Potts, Ross A. (Apr 19)

Pricher Jeffrey Cntr 868CS/SCOY

Barnyard reversing IPs Pricher Jeffrey Cntr 868CS/SCOY (Apr 23)

quentyn

Bonding - has anyone gotten it to work with an ether tap quentyn (May 28)
Re: AW: Bonding - has anyone gotten it to work with an ether tap quentyn (May 29)

radus

snort and slackware.. radus (Jun 27)

rakesh

Unable to start snort version 1.8.6 in Daemon mode rakesh (Apr 10)
(no subject) rakesh (Apr 11)

Ralf Hildebrandt

Re: SMTP RCPT TO overflow Ralf Hildebrandt (Apr 25)
Re: snort cvs complains Ralf Hildebrandt (Apr 20)
Re: what's preferred kernel? Ralf Hildebrandt (Apr 02)
Snort, Demarc and excessive logging Ralf Hildebrandt (Apr 16)
Re: Snort installation Ralf Hildebrandt (Jun 28)
Re: linux kernel? Ralf Hildebrandt (Apr 03)
Re: (no subject) Ralf Hildebrandt (Apr 25)
Re: SMTP Virus Gateway Ralf Hildebrandt (Jun 14)
Re: snort cvs complains Ralf Hildebrandt (Apr 20)
Todays checkout fails miserably... Ralf Hildebrandt (Apr 08)
snortsam Ralf Hildebrandt (May 15)
Re: Snort on HP-UX Ralf Hildebrandt (Apr 10)
snort CVS checkout fails to build Ralf Hildebrandt (Jun 16)
snort cvs complains Ralf Hildebrandt (Apr 20)
Re: IDS: SnortSam update: PIX and Cisco ACLs Ralf Hildebrandt (May 14)
Re: archive snort logs? Ralf Hildebrandt (Apr 03)

Raoul Armfield

Installing Snort on Win 2K Raoul Armfield (Jun 17)
RE: Installing Snort on Win 2K Raoul Armfield (Jun 18)

Raymond Jacob

How does one print out summary of unique addresses. Raymond Jacob (Apr 08)
ACID question Raymond Jacob (Apr 05)
Where does one find help with Acid? Raymond Jacob (Apr 14)

Reckhard, Tobias

Portscan false positives reg. DNS caching server Reckhard, Tobias (May 15)

Redman, Ken

Snort, MySQL, Acid Redman, Ken (May 03)
RE: Signature names Redman, Ken (Apr 24)
mysql 100% cpu utliization Redman, Ken (Apr 18)
Old rule getting set off a lot lately Redman, Ken (Apr 30)

Reinhard Doberstein

RE: Buffer too small for packet.dll? (was: Error i nitializing NIC) Reinhard Doberstein (Apr 25)
RE: Snort 1.8 Win32 Reinhard Doberstein (May 02)
RE: Error initializing NIC Reinhard Doberstein (Apr 24)
RE: Error initializing NIC Reinhard Doberstein (Apr 24)
RE: winpcap Reinhard Doberstein (Apr 29)

Renato Ara�jo

Detecting concurrent connections Renato Ara�jo (Jun 12)

René Bellora

Re: Looking for tool to generate isp/domain notification emails.... René Bellora (May 10)

Ricardo SIGNES

Re: TCP ******S* portscan Ricardo SIGNES (Apr 05)

Rich Adamson

Re: Hardware Questions Rich Adamson (May 22)
Anyone recognize this packet? Rich Adamson (Apr 03)
RE: Remote Syslog Rich Adamson (May 10)
Re: real basic starter rules Rich Adamson (Apr 27)
Re: (no subject) Rich Adamson (May 31)
Re: Logging to Remote syslog server Rich Adamson (Mar 31)

Richard Houston

(no subject) Richard Houston (Jun 12)

Richard Noonan

Re: acid on RH7.2 Richard Noonan (Apr 11)
acid on RH7.2 Richard Noonan (Apr 11)
Re: SNMP Problems Richard Noonan (May 02)

Richard Powell

Re: Libpcap library/headers not found... Richard Powell (Apr 10)

Richard Roy

SNORT newbie looking for some help with Snort on Win2k Richard Roy (May 15)
RE: SNORT newbie looking for some help with Snort o n Win2k Richard Roy (May 16)
snort with acid Richard Roy (May 15)

Richard Silver

RE: (no subject) Richard Silver (Jun 04)

Rimas

Snort rules update Rimas (Apr 03)

Risto Vaarandi

Re: centralized log Risto Vaarandi (May 17)
"id command attempt" rule Risto Vaarandi (Apr 29)

R . Janaki

Pass rules?? R . Janaki (May 07)
Ignore certain packets R . Janaki (May 11)

rms

VoIP, Internet Telephony Traffic rms (May 03)

Robbie Lee

unsubscribe Robbie Lee (Jun 18)

Robbins, Mark

RE: Problems logging to syslog and mysql simultaneo usly Robbins, Mark (Jun 20)

Robert M Gulledge

Out of the Office Robert M Gulledge (Apr 29)

Roberto Suarez Soto

Re: mysql archive tool Roberto Suarez Soto (Apr 30)
Re: DOS MSDTC attempt false positive Roberto Suarez Soto (May 09)
Re: Pass rules?? Roberto Suarez Soto (May 09)
Re: Problem getting Snort to Connect to PostgreSQL database Roberto Suarez Soto (May 16)
Re: SQLsnake - any able to create a sig for this one? Roberto Suarez Soto (May 22)
Re: Snort not loggin hack attempts Roberto Suarez Soto (Jun 25)
Re: ignore ping Roberto Suarez Soto (May 27)

Robert S.

RE: snortconf via web Robert S. (May 03)
RE: snort configuration using gui... Robert S. (May 19)
RE: snortconf via web Robert S. (May 03)

Robert Schwartz

RE: Snort at boot Robert Schwartz (Jun 18)
RE: OpenBSD, snort, Two nic's outside network Robert Schwartz (Jun 24)

Robert Spinelli

XP / Snort / Error opening device Robert Spinelli (Jun 30)

Rob Hughes

Re: flags Rob Hughes (Jun 09)
ATTN: Michael Scheidell Rob Hughes (Jun 05)
Re: All shellcode rules invalid Rob Hughes (Apr 13)
No more -z all? Rob Hughes (May 11)
FYI: New ucd agent && snort !good Rob Hughes (May 23)
Re: No more -z all? Rob Hughes (May 11)
Re: cannot compile snort on Freebsd 4.5 or 4.6 from cvs.....snort 1.8.6 compiles ok Rob Hughes (May 28)
Re: Weird issue with 1.8.6 and SMTP alerts Rob Hughes (May 21)
Re: flags Rob Hughes (Jun 08)
Re: Help with tcpdump log rotation Rob Hughes (May 09)
idmef on FreeBSD Rob Hughes (Apr 07)
Re: snort 1.87beta5 still holds some fds on HUP (fixed) Rob Hughes (May 31)
Help with tcpdump log rotation Rob Hughes (May 03)
Re: snort not logging Rob Hughes (Jun 09)
Re: snort not logging Rob Hughes (Jun 09)
Re: snort 1.87beta5 still holds some fds on HUP(fixed) Rob Hughes (Jun 03)
Re: Help with tcpdump log rotation Rob Hughes (May 10)
Re: No more -z all? Rob Hughes (May 12)
All shellcode rules invalid Rob Hughes (Apr 12)

Robin Brown

RE: Problem emailing alerts from ACID Robin Brown (Jun 18)
RE: PureSecure is crazy Robin Brown (Jun 18)
snort and puresecure problem Robin Brown (Jun 26)

Robinson, Eric R.

Snort Logs to MySQL, ACID Sees the Alerts, But Queries Don't Work Robinson, Eric R. (Jun 04)

Rodney Kanno

newbie: merging rulesets Rodney Kanno (May 05)

Rodney Wise

RE: Installing Snort on Win 2K Rodney Wise (Jun 17)
RE: Installing Snort on Win 2K Rodney Wise (Jun 18)

Roelof JT Jonkman

Re: How much can snort Snort? Roelof JT Jonkman (Apr 15)
Re: barnyard and demarc question Roelof JT Jonkman (May 01)
Re: FrontPage Events Roelof JT Jonkman (Apr 04)

Roger

solaris 8 compile Roger (Jun 10)

roman

Re: Acid Fatal error roman (Apr 19)
Re: snort with mysql and acid roman (Jun 12)
Re: OT queries on acid in confusion... roman (Jun 19)
Re: Lost ACID database queries roman (Jun 28)
Re: schema version 104 roman (May 31)
Re: Dies roman (Jun 13)
Re: Re: Mysql problem roman (Jun 22)
Re: OT queries on acid in confusion... roman (Jun 20)
Re: 'more than one result' error messages roman (Apr 15)
Re: Patch for bug in Acid criteria removal roman (Apr 11)
Re: use of tables roman (Jun 12)
Re: 1.8.5 mysql_error roman (Apr 04)
Re: schema version 104 roman (May 31)
Re: Snort database relationship info? roman (Apr 11)

Roman Danyliw

Re: Patch for Time criteria handling in ACID Roman Danyliw (Jun 15)
Re: snort-mysql installation - not logging Roman Danyliw (Jun 26)
Re: simple mistake in icmp payload calculation Roman Danyliw (Apr 20)
Re: patch to reference.config? Roman Danyliw (May 19)
Re: Problem with ACID and Solution. Roman Danyliw (Jun 15)
New database plugin documentation Roman Danyliw (Apr 14)
Re: undefined reference to `dlopen' Roman Danyliw (Jun 25)

Ronald Beaulieu

Rép. : Re: [Snort-users] running 2 instances of snort under Demarc Ronald Beaulieu (May 27)
Rép. : [Snort-users] demarc: validate Ronald Beaulieu (May 16)

Ronald Nutter

Which rules to use for snort ? Ronald Nutter (Jun 02)
RE: Which rules to use for snort ? Ronald Nutter (Jun 03)

Ronald Prins

cmd.exe Ronald Prins (Apr 29)

Ron DuFresne

Re: fragroute vs. snort: the tempest in a teacup Ron DuFresne (Apr 19)
RE: fragroute vs. snort: the tempest in a teacup Ron DuFresne (Apr 25)

Ronneil Camara

logging to remote syslog Ronneil Camara (May 23)
RE: Snort/ACID Database Cleanup Ronneil Camara (Apr 12)
rule for Yahoo or Hotmail messengers Ronneil Camara (Jun 16)
RE: Flexresp Ronneil Camara (Apr 08)
RE: Flexresp Ronneil Camara (Apr 08)
linux kernel? Ronneil Camara (Apr 02)
RE: ERROR LOG Ronneil Camara (Apr 18)
RE: Blocking individual IP's Ronneil Camara (Apr 11)
RE: logging to remote syslog Ronneil Camara (May 23)
how to not to log Ronneil Camara (Apr 03)
I found a bug Ronneil Camara (Apr 15)
RE: Problem emailing alerts from ACID Ronneil Camara (Jun 17)
RE: looks false-positive Ronneil Camara (Apr 11)
RE: ./configure --with-mysql= ? Ronneil Camara (Apr 02)
looks false-positive Ronneil Camara (Apr 11)
RE: looks false-positive Ronneil Camara (Apr 11)
RE: Problem emailing alerts from ACID Ronneil Camara (Jun 17)
RE: snort cvs complains Ronneil Camara (Apr 20)
RE: Snort 1.8.6 is Available! Ronneil Camara (Apr 08)
RE: I found a bug Ronneil Camara (Apr 15)
signature for a virus Ronneil Camara (Apr 18)
is this a bad traffic? Ronneil Camara (Apr 10)
RE: Would you suspect? Ronneil Camara (Apr 11)
Is this a real nimda? Ronneil Camara (Apr 25)
RE: Would you suspect? Ronneil Camara (Apr 11)
Would you suspect? Ronneil Camara (Apr 11)
RE: Flexresp Ronneil Camara (Apr 08)

Rose, Jerry L SAJ Contractor

Snort.conf question $HOME_NET Question V1.8.6 Rose, Jerry L SAJ Contractor (May 14)
Snort > mysql > acid - timestamp troubles Rose, Jerry L SAJ Contractor (May 29)

Roshen Chandran

Tagging and Packet Payload Roshen Chandran (Jun 03)

Ross Draper

Lost in the config file and searchable archives Ross Draper (Jun 27)
ACID url Links on IIS Ross Draper (Jun 23)

Ross Tsolakidis

RE: snort not logging to log files.. Ross Tsolakidis (Apr 22)
snort not logging to log files.. Ross Tsolakidis (Apr 19)

Russell Fulton

snort sigs for Solaris login exploit? Russell Fulton (Apr 25)
Remote Syslog Russell Fulton (May 09)
snort signatures on www.snort.org Russell Fulton (May 28)

Ryan Hill

RE: weird behaviour with Puresecure Ryan Hill (May 06)
RE: WG: Demarc Security Update Advisory Ryan Hill (Apr 18)
RE: Portscan.log utility Ryan Hill (May 01)
RE: demarc: validate Ryan Hill (May 15)
RE: Snort IGNORES var HOME_NET Ryan Hill (May 03)
RE: snort 1.8.6 db schema? Ryan Hill (Apr 29)
RE: Best real-time alerting tool Ryan Hill (Jun 05)
RE: OT what's preferred kernel? Ryan Hill (Apr 02)
OT: ipfilter Suggestions for Snort Use Ryan Hill (Apr 22)
got demarc 1.6? Ryan Hill (Apr 26)
RE: PureSecure 1.6 Ryan Hill (May 15)
snort 1.8.6 db schema? Ryan Hill (Apr 29)
RE: Snort + Demarc Remote logging? Ryan Hill (May 13)
FW: Demarc PureSecure 1.05 may be other (user can bypass login) Ryan Hill (Apr 16)
RE: demarc: validate Ryan Hill (May 15)
RE: Portscanning from my network Ryan Hill (Apr 08)
FW: RE: weird behaviour with Puresecure Ryan Hill (May 07)
spp_portscan behavior is 1.8.6 Ryan Hill (May 22)
port lists for 1.8 Ryan Hill (Jun 25)

Ryan Russell

Re: Need help with a rule Ryan Russell (Apr 09)
Re: Compile problems on solaris 2.6 Ryan Russell (Jun 10)
Re: upgrading from 1.8.4 to 1.8.6 Ryan Russell (Apr 09)
Re: flexresp on 1.8.6 with red hat 7.2 Ryan Russell (May 30)
Re: SSL CodeRed et al Ryan Russell (May 28)
RE: Need help with a rule Ryan Russell (Apr 09)
Re: Snort rules touble. Ryan Russell (Jun 21)
Re: mismatch. Ryan Russell (Jun 29)
Re: what does this mean Ryan Russell (Apr 05)

Saad Kadhi

Re: insertion and evasion Saad Kadhi (Apr 18)

Safka

RE: Anomalous packet logged by Snort Safka (Apr 14)

Salomon, Charlie

nmap scans don't appear in portscan.log Salomon, Charlie (Apr 01)

Salvatore Basso

problema with snort for linux Salvatore Basso (Jun 18)
Multiple IP Salvatore Basso (May 31)
Re: Multiple IP Salvatore Basso (Jun 04)
Snort send mail on alert Salvatore Basso (Jun 18)

Sam

Re: ERROR LOG Sam (Apr 18)

Sam Evans

Curse of the cmd.exe Sam Evans (Jun 13)

Sandy Martin

Snort Questions Sandy Martin (Jun 20)

Santoro, David

Snort not loggin hack attempts Santoro, David (Jun 25)

Schlotterer, Matthew

Cron Script Schlotterer, Matthew (May 23)

Scot Scot

Re: Setting up a Windowz Interface to monitor with no IP Address Scot Scot (Jun 28)
Re: : Configuration HELP! (understanding alerts and proxies) Scot Scot (Jun 12)
Setting up a Windowz Interface to monitor with no IP Address Scot Scot (Jun 27)
Re: I think I know the answer to this, but not 100% sure Scot Scot (Jun 26)
Re: Syslog on W2K Scot Scot (Jun 12)
Re: portscan-ignorehosts question Scot Scot (Jun 05)
Re: Testing tools Scot Scot (Jun 16)
Re: Cisco PIX firwalls & Cisco Routers Scot Scot (Apr 13)
Re: Tying alerts to hostnames? - Windowz Tools Scot Scot (Jun 18)

ScotScot

Re: what is good ScotScot (Apr 21)
Re: packet generator ScotScot (May 04)
Re: what is good ScotScot (Apr 21)
Re: Snort Log Despoofer ScotScot (May 15)

Scott Doane

Re: snort & mysql Scott Doane (Apr 13)

Scott Fringer

Re: include problem in 1.8.6 Scott Fringer (Apr 10)

Scott McGee

Re: Snort in a switched environment Scott McGee (May 14)
Re: Snort in a switched environment Scott McGee (May 15)

Scott Nursten

Re: Snort Working Mechanism Scott Nursten (Apr 02)
Re: Snort Solaris 8 with quad card Scott Nursten (Apr 02)

Scott Phippen

Tying alerts to hostnames? Scott Phippen (Jun 17)

Scott Stokes

RE: Demarc database schema issue Scott Stokes (Apr 14)

Scott Taylor

OT: Deciphering log entry(iptables) Scott Taylor (Apr 02)

Scott Weeks

newbie snort user on windows xp needs help please Scott Weeks (Jun 25)
RE: newbie snort user on windows xp needs help please Scott Weeks (Jun 28)
RE: newbie snort user on windows xp needs help please Scott Weeks (Jun 27)

Sean A Ensz/cis/evp/Okstate

gigabit ids Sean A Ensz/cis/evp/Okstate (Apr 24)

Sean T. Ballard

RE: whitehats.com is online again Sean T. Ballard (Apr 05)
RE: ACTION: Snort user's group in NOVA ? Sean T. Ballard (Apr 29)
RE: Blocking individual IP's Sean T. Ballard (Apr 11)
RE: SSL CodeRed et al Sean T. Ballard (May 28)

Sean Wheeler

snort-current rules syntax error Sean Wheeler (Apr 16)

secsnort

Re: Error opening adapter... secsnort (Apr 09)

Semerjian, Ohanes

RE: Multiple IP (ethernet switches vs hubs) Semerjian, Ohanes (Jun 03)
RE: snort wont log to mysql database Semerjian, Ohanes (Apr 29)
RE: Strange UDP packets from MS Exchange servers Semerjian, Ohanes (Apr 29)

Sentinel Sentinel

Re: snort and big brother Sentinel Sentinel (Apr 24)
RE: ACID Database Cleanup (data.MYD) Sentinel Sentinel (Apr 29)

Serge Leschinsky

EXTERNAL_NET = any - HOME_NET Serge Leschinsky (Jun 26)
Re[2]: EXTERNAL_NET = any - HOME_NET Serge Leschinsky (Jun 26)
Re[2]: EXTERNAL_NET = any - HOME_NET Serge Leschinsky (Jun 26)

Shane Hickey

Snort and MRTG Shane Hickey (Jun 11)
Snort and Logwatch Shane Hickey (Apr 08)
Fine-tuning a rule Shane Hickey (May 17)

Shane Williams

Re: *****SPAM***** Subliminal html in spam? Shane Williams (Apr 06)

Shawn Duffy

Re: MySQL Shawn Duffy (Apr 27)
Re: Snort front ends Shawn Duffy (Jun 13)
Re: Demarc database schema issue Shawn Duffy (Apr 02)

sheabo

Error initializing NIC sheabo (Apr 24)

Sheahan, Paul (PCLN-NW)

Alert but NOT log? Sheahan, Paul (PCLN-NW) (Apr 03)
RE: How to ignore scan from a host Sheahan, Paul (PCLN-NW) (Apr 16)
RE: Flexresp Sheahan, Paul (PCLN-NW) (Apr 08)
Razorback Sheahan, Paul (PCLN-NW) (Apr 25)
IGMP traffic Sheahan, Paul (PCLN-NW) (Apr 12)
RE: Best real-time alerting tool Sheahan, Paul (PCLN-NW) (Jun 05)
RE: Alert but NOT log? Sheahan, Paul (PCLN-NW) (Apr 05)
RE: Portscanning from my network Sheahan, Paul (PCLN-NW) (Apr 08)
RE: Need help with a rule Sheahan, Paul (PCLN-NW) (Apr 09)
RE: snort_stat.pl Sheahan, Paul (PCLN-NW) (Apr 18)
Best real-time alerting tool Sheahan, Paul (PCLN-NW) (Jun 04)
Force a server to send fragments? Sheahan, Paul (PCLN-NW) (Apr 02)
Need help with a rule Sheahan, Paul (PCLN-NW) (Apr 09)
RE: Alert but NOT log? Sheahan, Paul (PCLN-NW) (Apr 03)
Strange UDP packets from MS Exchange servers Sheahan, Paul (PCLN-NW) (Apr 29)
content-list rule won't work Sheahan, Paul (PCLN-NW) (Apr 04)
RE: newbie question Sheahan, Paul (PCLN-NW) (Apr 10)
RE: Source Port 0 traffic Sheahan, Paul (PCLN-NW) (Apr 12)
RE: Is this a real nimda? Sheahan, Paul (PCLN-NW) (Apr 25)
RE: Placement of Snort IDS Sheahan, Paul (PCLN-NW) (Apr 10)
RE: Fragments and stuff Sheahan, Paul (PCLN-NW) (Apr 30)
SYN Flood preprocessor? Sheahan, Paul (PCLN-NW) (Apr 01)
RE: Would you suspect? Sheahan, Paul (PCLN-NW) (Apr 11)
RE: Thoughts on internal vs. external IDS rulesets Sheahan, Paul (PCLN-NW) (Apr 11)
RE: Thoughts on internal vs. external IDS rulesets Sheahan, Paul (PCLN-NW) (Apr 10)
RE: snort_stat Sheahan, Paul (PCLN-NW) (Apr 11)
RE: private IP scans Sheahan, Paul (PCLN-NW) (Apr 08)

SkatFiend

Re: running 2 instances of snort under Demarc SkatFiend (May 23)
Hardware Questions SkatFiend (May 22)
Re: Snorting the MAC address SkatFiend (Apr 12)
running 2 instances of snort under Demarc SkatFiend (May 17)

skill 's

Re: Re: Off topic: Thousands of traceroutes ? skill 's (May 13)
Re: Multiple Content (not working?) skill 's (May 15)

Skip Carter

Re: Using Snort for Wireless Skip Carter (Apr 03)
Re: archive snort logs? Skip Carter (Apr 04)
Re: Is this a valid traffic? Skip Carter (Apr 03)
Re: Snort dying unexpectedly Skip Carter (Apr 25)

Slade Edmonds

monitoring https / SSL Slade Edmonds (May 02)

Slighter, Tim

RE: Snort rules touble. Slighter, Tim (Jun 21)
RE: Preventing Attacks Slighter, Tim (Jun 26)
RE: Setting up a Windowz Interface to monitor with no IP Address Slighter, Tim (Jun 28)
RE: problema with snort for linux Slighter, Tim (Jun 18)
RE: 1.8.6 and tcpdump format Slighter, Tim (May 22)
RE: Snort rules touble. Slighter, Tim (Jun 21)
RE: False positives with SMTP RCPT TO overflow rule Slighter, Tim (Jun 26)
RE: Snort / SnortSnarf question about packet captur e filenames Slighter, Tim (Jun 26)
RE: SNORT newbie looking for some help with Snort o n Win2k Slighter, Tim (May 15)
RE: Snort 1.8.7 and fragroute Slighter, Tim (Jun 24)
RE: Snort / SnortSnarf question about packet captur e filenames Slighter, Tim (Jun 26)
RE: Snort rules touble. Slighter, Tim (Jun 21)
RE: Snort rules touble. Slighter, Tim (Jun 21)
snort-stable-snapshot.tar.gz & snort-daily.tar.gz Slighter, Tim (May 31)
RE: Snort / SnortSnarf question about packet captur e filenames Slighter, Tim (Jun 26)
RE: Setting up a Windowz Interface to monitor with no IP Address Slighter, Tim (Jun 28)
RE: Setting up a Windowz Interface to monitor with no IP Address Slighter, Tim (Jun 28)
RE: How do I ignore portscans from everything but H OME_NET? Slighter, Tim (Apr 10)
RE: False positives with SMTP RCPT TO overflow rule Slighter, Tim (Jun 25)
RE: portscan.log empty despite nmap scan? Slighter, Tim (Jun 21)

Smith, Israel G

RE: Snort database relationship info? Smith, Israel G (Apr 11)
Snort database relationship info? Smith, Israel G (Apr 11)

Somak S

SETTING UP SNORT Somak S (May 27)

Sonika Malhotra

Re: Snort Working Mechanism Sonika Malhotra (Apr 03)
Re: Snort Working Mechanism Sonika Malhotra (Apr 03)
Snort Working Mechanism Sonika Malhotra (Apr 02)

Spitzer, Nathan

RE: Wireless monitoring Spitzer, Nathan (May 22)
RE: Help with monitoring sending packet rate Spitzer, Nathan (May 15)
RE: Off topic: Thousands of traceroutes ? Spitzer, Nathan (May 13)
RE: Snort in a switched environment Spitzer, Nathan (May 14)
RE: Bandwidth Information Spitzer, Nathan (May 29)
RE: Snort loading at startup Spitzer, Nathan (May 14)

spy

Snort ---> syslog spy (Jun 20)

Spy Guy

Rule to log Instant Messaging connections Spy Guy (May 22)
Question about Demarc Spy Guy (Apr 19)

spyguy703

Too many events in logs spyguy703 (May 23)

Stefan Dens

Re: Snort front ends Stefan Dens (Jun 14)

Stephan Helas

snort and firewall Stephan Helas (May 15)
spp_portscann don't work Stephan Helas (May 24)
Logging Problem Stephan Helas (May 28)

Stephen C Burns

Ignoring all traffic from a certain network Stephen C Burns (Apr 15)
Ignoring all traffic from a certain network Stephen C Burns (Apr 15)
Setting an alert for a "connection threshold" Stephen C Burns (Apr 17)