Snort: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

2165 messages starting Sep 30 03 and ending Dec 31 03
Date index | Thread index | Author index

• snort dnis on modem tranceformer (Sep 30)
• Re: Can't build RPM using SRPM (snort-2.0.2-4) JP Vossen (Sep 30)
• Snort-MySQL problem Syed Zuhdi Syed Salim (Sep 30)
  • Re: Snort-MySQL problem Edin Dizdarevic (Oct 01)
    • Message not available
      • Re: Snort-MySQL problem Edin Dizdarevic (Oct 01)
  • <Possible follow-ups>
  • Re: Snort-MySQL problem Shawn Truax (Oct 01)
  • Snort-MySQL problem Syed Zuhdi Syed Salim (Oct 01)
  • RE: Snort-MySQL problem CMartin (Oct 01)
    • RE: Snort-MySQL problem Syed Zuhdi Syed Salim (Oct 01)
  • RE: Snort-MySQL problem CMartin (Oct 02)
  • RE: Snort-MySQL problem Shawn Truax (Oct 06)
  • RE: Snort-MySQL problem Shawn Truax (Oct 13)
• Re: Single Snort instance with multipleconfigurations (output) Shawn Truax (Oct 01)
• RE: Snort 2.0.2 with MySQL PPowenski (Oct 01)
• flexresp2 not working in snort 2.0.2 Nerijus Krukauskas (Oct 01)
  • Re: flexresp2 not working in snort 2.0.2 Jeff Nathan (Oct 02)
• problem in snort.. Reshmi Jain (Oct 01)
  • Re: problem in snort.. scott j. lopez (Oct 02)
• [PATCH]: bad calculation of the amount of drop. Yoann Vandoorselaere (Oct 01)
• does snort must have its own ip address ? חואן (Oct 01)
  • Re: does snort must have its own ip address ? Matt Kettler (Oct 01)
• alert_unified only John Byrnes (Oct 01)
  • Re: alert_unified only Chris Green (Oct 01)
  • Snort rules merging and duplicate entries (3D Linked List) Jukka Juslin (Oct 02)
  • Re: alert_unified only Erek Adams (Oct 05)
• Rob Flentge/Mechanicsburg/US/Exel is out of the office. Rob Flentge (Oct 01)
  • <Possible follow-ups>
  • Rob Flentge/Mechanicsburg/US/Exel is out of the office. Rob Flentge (Oct 09)
  • Rob Flentge/Mechanicsburg/US/Exel is out of the office. Rob Flentge (Nov 12)
    • Message not available
      • Re: Rob Flentge/Mechanicsburg/US/Exel is out of the office. [OT] Matt Kettler (Nov 12)
      • Re: Rob Flentge/Mechanicsburg/US/Exel is out of the office. [OT] twig les (Nov 12)
  • Re: Rob Flentge/Mechanicsburg/US/Exel is out of the office. MH (Nov 15)
• What are the differences between and IPS and IDS? Chhabria, Kavita - Apogent (Oct 01)
  • Re: What are the differences between and IPS and IDS? twig les (Oct 01)
  • Message not available
    • Re: What are the differences between and IPS and IDS? Matt Kettler (Oct 01)
      • Re: What are the differences between and IPS and IDS? Ravi Kumar (Oct 01)
      • block connections in IPS Ravi Kumar (Oct 01)
      • Re: block connections in IPS Geoff (Oct 01)
      • RE: block connections in IPS Michael Steele (Oct 02)
      • Re: block connections in IPS Ravi Kumar (Oct 02)
      • Re: block connections in IPS Geoff (Oct 02)
      • Re: block connections in IPS Ravi Kumar (Oct 02)
      • Re: block connections in IPS Matt Kettler (Oct 03)
  • RE: What are the differences between and IPS and IDS? Michael Steele (Oct 01)
  • <Possible follow-ups>
  • Re: What are the differences between and IPS and IDS? Ganu Skop (Oct 04)
• RE: SnortSnarf in Windows snort-ml (Oct 01)
  • <Possible follow-ups>
  • RE: SnortSnarf in Windows snort-ml (Oct 02)
  • RE: SnortSnarf in Windows snort-ml (Oct 02)
  • RE: SnortSnarf in Windows snort-ml (Oct 03)
    • RE: SnortSnarf in Windows Michael Steele (Oct 03)
  • RE: SnortSnarf in Windows snort-ml (Oct 05)
    • RE: SnortSnarf in Windows Michael Steele (Oct 05)
  • RE: SnortSnarf in Windows snort-ml (Oct 07)
    • RE: SnortSnarf in Windows Michael Steele (Oct 07)
  • RE: SnortSnarf in Windows Everist, Benjamin S. (NASWI) (Oct 07)
    • RE: SnortSnarf in Windows Michael Steele (Oct 07)
    • RE: SnortSnarf in Windows Michael Steele (Oct 07)
    • RE: SnortSnarf in Windows Michael Steele (Oct 07)
  • RE: SnortSnarf in Windows snort-ml (Oct 10)
• IPS best practice guide pieter claassen (Oct 02)
• SnortCenter Errors with Byte_Test? Robert Craig (Oct 02)
• Byte_test SnortCenter Troubles?!? Rob Craig (Oct 02)
• UPnP Lopez, Frank (Oct 02)
• alert_unixsock William Morris (Oct 02)
  • <Possible follow-ups>
  • alert_unixsock Nic¤ (Oct 16)
    • Re: alert_unixsock Erek Adams (Oct 16)
      • Re: alert_unixsock Frank Knobbe (Oct 16)
      • Re: alert_unixsock Erek Adams (Oct 22)
• How does snort do packet signature detection? Chhabria, Kavita - Apogent (Oct 02)
  • Message not available
    • Re: How does snort do packet signature detection? Matt Kettler (Oct 02)
      • RE: How does snort do packet signature detection? Hernan Bugallo (Oct 04)
      • RE: How does snort do packet signature detection? Matt Kettler (Oct 02)
  • Re: How does snort do packet signature detection? james (Oct 02)
• RE: block connections in IPS] Geoff (Oct 02)
  • Re: block connections in IPS] Jeff Nathan (Oct 02)
• Re: Snort rules merging and duplicate entries (3D Linked List) scheidell (Oct 02)
• Is there a separate mailing list for snortcenter related question s? Chhabria, Kavita - Apogent (Oct 02)
• How do you start and stop a sensor from snortcenter management co nsole? Chhabria, Kavita - Apogent (Oct 02)
• on windows RAGUNATHAN, SOUMYA (Oct 02)
  • RE: on windows Michael Steele (Oct 02)
• Blocking attacking IP address for some time using Snort and PIX kanwal jeet (Oct 02)
  • Re: Blocking attacking IP address for some time using Snort and PIX Matt Kettler (Oct 02)
  • Re: Blocking attacking IP address for some time using Snort and PIX Frank Knobbe (Oct 04)
    • Re: Blocking attacking IP address for some time using Snort and PIX kanwal jeet (Oct 02)
• mysql.sock Chris Feldmann (Oct 02)
  • Re: mysql.sock Erek Adams (Oct 02)
    • Re: mysql.sock Chris Feldmann (Oct 03)
      • Re: mysql.sock MH (Oct 04)
  • <Possible follow-ups>
  • RE: mysql.sock PPowenski (Oct 03)
    • RE: mysql.sock Erek Adams (Oct 03)
• Problem during snort-mysql installation. rajeswaran mugesh (Oct 02)
• Snort on windows pmahesh90979 (Oct 02)
  • RE: Snort on windows Michael Steele (Oct 03)
  • Message not available
    • Re: Snort on windows Matt Kettler (Oct 03)
• Snort/MYSQL Error Haamid, Abdul Qaadir (Oct 03)
• Trigger of multiple rules Denny Page (Oct 03)
• Logging to database and not to log directory bluerain () pandora be (Oct 04)
  • Re: Logging to database and not to log directory Gnik (Oct 04)
• Wipe out Snort database Egal A Egal - SA (Oct 04)
  • Re: Wipe out Snort database Paul Schmehl (Oct 04)
• which book on snort ? peter pilsl (Oct 04)
  • Re: which book on snort ? Rudi Starcevic (Oct 04)
• SRI patent on "Hierarchical event monitoring and analysis" Richard Bejtlich (Oct 04)
  • QUASHING thread: SRI patent on "Hierarchical event monitoring and analysis" Jeff Nathan (Oct 04)
  • Re: SRI patent on "Hierarchical event monitoring and analysis" Rich Adamson (Oct 05)
  • Re: SRI patent on "Hierarchical event monitoring and analysis" Martin Roesch (Oct 06)
• Snort Rules jbendure (Oct 05)
  • Re: Snort Rules Irwan Hadi (Oct 05)
  • <Possible follow-ups>
  • Snort Rules Martin Jr., D. Michael (Oct 21)
    • Message not available
      • Re: Snort Rules Matt Kettler (Oct 21)
  • Snort Rules Fabio A. Bicudo Duarte (Nov 04)
  • RE: Snort Rules Snort (Nov 04)
    • Re: Snort Rules mouss (Nov 07)
  • Snort Rules Singh,Manoj [Ontario] (Nov 24)
  • Snort Rules Singh,Manoj [Ontario] (Nov 26)
    • RE: Snort Rules Michael Steele (Nov 26)
• snort books Chris Feldmann (Oct 05)
• Data_payload logging in database is truncated Niko (Oct 05)
  • <Possible follow-ups>
  • Data_payload logging in database is truncated Niko (Oct 11)
• Installation problem with snort. rajeswaran mugesh (Oct 05)
  • Re: Installation problem with snort. Ravi Kumar (Oct 06)
    • Re: Installation problem with snort. Daniel Wittenberg (Oct 06)
• Official Grand Opening of - WINSNORT.com Michael Steele (Oct 05)
• Ignored XXX Duplicate alerts Brei, Matt (Oct 06)
• Re: [Snort-sigs] ARP scan jon baer (Oct 06)
• problem with PerfMonitor sherif tawfic (Oct 06)
  • Re: problem with PerfMonitor Edin Dizdarevic (Oct 06)
• difficulties in ALERT generation... santosh reddy (Oct 06)
• Synchronizing archive and live DBs John Creegan (Oct 06)
• Can we send email using Outlook as the smtp server with ACID? Chhabria, Kavita - Apogent (Oct 06)
  • Re: Can we send email using Outlook as the smtp server with ACID? Demetri Mouratis (Oct 06)
    • RE: Can we send email using Outlook as the smtp server with ACID? Michael Steele (Oct 06)
• Snort Kernel Module Josh Berry (Oct 06)
  • Message not available
    • Re: Snort Kernel Module Matt Kettler (Oct 06)
      • Re: Snort Kernel Module Josh Berry (Oct 06)
      • Re: Snort Kernel Module Mark Nipper (Oct 06)
      • Re: Snort Kernel Module Jason Haar (Oct 06)
      • Re: Snort Kernel Module pieter claassen (Oct 06)
      • Re: Snort Kernel Module Josh Berry (Oct 06)
  • portscan traffic & acid wb (Nov 07)
  • <Possible follow-ups>
  • Re: Snort Kernel Module Ravi Kumar (Oct 06)
    • Re: Snort Kernel Module Dragos Ruiu (Oct 07)
      • Re: Snort Kernel Module pieter claassen (Oct 07)
• Snort fails to dump alerts to Solaris 8 Syslog Richard Pitkanen (Oct 06)
  • Re: Snort fails to dump alerts to Solaris 8 Syslog Erek Adams (Oct 07)
• NIDS test steps twig les (Oct 06)
• Snort on RH 9 Updated documentation Patrick Harper (Oct 06)
• Remote Syslog... Mike Koponick (Oct 06)
  • <Possible follow-ups>
  • Remote Syslog... Mike Koponick (Oct 06)
    • Re: Remote Syslog... Erek Adams (Oct 07)
• Snort - ACID Displays NO data on IE fkseow (Oct 06)
• Snort.org packages with bad sigs? monroe (Oct 06)
  • Re: Snort.org packages with bad sigs? Daniel Wittenberg (Oct 07)
• Brian Denicola/US/ABNAMRO/NL is out of the office. brian . denicola (Oct 06)
• Re:Snort installation problem rajeswaran mugesh (Oct 07)
• snort-inline question Harry Brueckner (Oct 07)
  • Message not available
    • Re: snort-inline question Harry Brueckner (Oct 07)
      • Re: snort-inline question Guillaume Rix (Oct 07)
      • Re: snort-inline question seclists (Oct 07)
      • Message not available
      • Re: snort-inline question Harry Brueckner (Oct 07)
• Re: Snort Installation trouble. rajeswaran mugesh (Oct 07)
• Snort 2.0.2 payload corruption/Mix up. Patrik Astrom (Oct 07)
• acid - barnyard - payload Jochen Vogel (Oct 07)
• Re: Snort-2.0.0 : ODBC : Unnable to Connect Rodrigo Lima de Oliveira (Oct 07)
• Snort service fails to start Michael (Oct 07)
  • RE: Snort service fails to start Gnik N. (Oct 07)
• Snort 2.0.2 install location Derek Fairley (Oct 07)
  • Re: Snort 2.0.2 install location Erek Adams (Oct 07)
  • Re: Snort 2.0.2 install location Patrick Harper (Oct 07)
• mysql-Problem Albert Einstein (Oct 07)
  • <Possible follow-ups>
  • RE: mysql-Problem PPowenski (Oct 07)
    • RE: mysql-Problem risc (Oct 07)
      • RE: mysql-Problem Daniel Wittenberg (Oct 07)
    • RE: mysql-Problem Daniel Wittenberg (Oct 07)
      • RE: mysql-Problem risc (Oct 07)
• |> Starting Snort service failed Michael (Oct 07)
• How to install oinkmaster-0.8? Snortty (Oct 07)
  • Re: How to install oinkmaster-0.8? Daniel Wittenberg (Oct 07)
  • <Possible follow-ups>
  • RE: How to install oinkmaster-0.8? Grime, Richard S (Oct 07)
• Snort not talking to the sql server. Timmy Jones (Oct 07)
• Snort Implementation Adam Towarnyckyj (Oct 07)
  • Re: Snort Implementation Jeff Pricher (Oct 07)
• Snort Compile Error: "Undefined referenence to uncompress" Infosec Account (Oct 07)
• difficulties in alert generation santosh reddy (Oct 07)
  • Re: difficulties in alert generation Nick Oliver (Oct 07)
    • Re: difficulties in alert generation risc (Oct 07)
• Strange Loopback Traffic Chad Gross - Loretel (Oct 07)
  • Re: Strange Loopback Traffic Frank Knobbe (Oct 07)
    • Re[2]: Strange Loopback Traffic Jyri Hovila (Oct 08)
      • Re: Re[2]: Strange Loopback Traffic Frank Knobbe (Oct 10)
    • SnortCenter Sensor failed to start samwun (Oct 18)
  • <Possible follow-ups>
  • Strange Loopback traffic Scott Weller (Oct 10)
• Notes on Sourcefire seminar Richard Bejtlich (Oct 07)
• snort + cisco 4x00 catalysts Paulo Filipe Mira (Oct 08)
  • Re: snort + cisco 4x00 catalysts twig les (Oct 08)
    • RE: snort + cisco 4x00 catalysts Paulo Filipe Mira (Oct 13)
• AW: acid - barnyard - payload Jochen Vogel (Oct 08)
  • <Possible follow-ups>
  • AW: acid - barnyard - payload Jochen Vogel (Oct 09)
  • AW: acid - barnyard - payload Jochen Vogel (Oct 13)
• Re: Snort Compile Error: "Undefined referenence to uncompress" Infosec Account (Oct 08)
• libmysqlclient: undefined reference to `uncompress' Michael casale (Oct 08)
• Information Not Appearing On ACID Console Kaplan, Andrew H. (Oct 08)
  • Re: Information Not Appearing On ACID Console Valter Santos (Oct 08)
  • <Possible follow-ups>
  • RE: Information Not Appearing On ACID Console Kaplan, Andrew H. (Oct 08)
    • RE: Information Not Appearing On ACID Console Ralf Spenneberg (Oct 09)
• Barnyard John Creegan (Oct 08)
  • Re: Barnyard Jeff Nathan (Oct 08)
  • <Possible follow-ups>
  • Barnyard John Creegan (Oct 08)
  • Barnyard John Creegan (Oct 08)
  • Barnyard John Creegan (Oct 08)
    • Re: Barnyard Jeff Nathan (Oct 08)
  • RE: Barnyard Steven Rudolph (Oct 09)
  • Re: Barnyard John Creegan (Oct 09)
  • Re:Barnyard John Creegan (Oct 09)
    • Re: Re:Barnyard Jeff Nathan (Oct 09)
  • Re:Barnyard John Creegan (Oct 10)
    • Re: Re:Barnyard Jeff Nathan (Oct 10)
  • Re:Barnyard Marc Quibell (Oct 10)
• Help with barnyard. Chhabria, Kavita - Apogent (Oct 08)
  • Re: Help with barnyard. Andrew R. Baker (Oct 08)
• sguil and barnyard errors Kerry Cox (Oct 08)
  • Re: sguil and barnyard errors Bamm Visscher (Oct 08)
• how to e-mail alerts from acid page santosh reddy (Oct 08)
  • <Possible follow-ups>
  • RE: how to e-mail alerts from acid page Schmehl, Paul L (Oct 08)
• Unknown Datagram decoding problem! CGhercoias (Oct 08)
• SNORT 2.0.0 :: ODBC :: FREETDS :: SQL SERVER Rodrigo Lima de Oliveira (Oct 08)
  • <Possible follow-ups>
  • Re: SNORT 2.0.0 :: ODBC :: FREETDS :: SQL SERVER Secureplay (Oct 09)
• monitoring pflog0 on obsd Shawn Posthumus (Oct 08)
  • Re: monitoring pflog0 on obsd Mark Nipper (Oct 08)
  • Re: monitoring pflog0 on obsd MH (Oct 08)
    • Re: monitoring pflog0 on obsd Mark Nipper (Oct 08)
    • Message not available
      • Re: monitoring pflog0 on obsd MH (Oct 08)
      • Re: monitoring pflog0 on obsd Shawn Posthumus (Oct 08)
• Local Whois doesn't work in ACID. Juan M. Rivera (Oct 08)
• (no subject) Kristian Schling (Oct 08)
  • Re: (no subject) Ralf Spenneberg (Oct 09)
  • <Possible follow-ups>
  • (no subject) Dave . Hartley (Oct 15)
  • (no subject) Cluett, Russell (Oct 22)
  • (no subject) Bob Apthorpe (Oct 28)
  • (no subject) Kaplan, Andrew H. (Nov 04)
    • Re: (no subject) Olaf Schreck (Nov 04)
  • RE: (no subject) Kaplan, Andrew H. (Nov 05)
  • RE: (no subject) Kaplan, Andrew H. (Nov 05)
  • (no subject) CGhercoias (Dec 01)
    • Message not available
      • Re: (no subject) Matt Kettler (Dec 01)
    • Re: (no subject) Jim Brown (Dec 01)
  • (no subject) wfz (Dec 05)
  • (no subject) Andrew Sergeyev (Dec 12)
  • (no subject) Russell Fulton (Dec 12)
  • (no subject) JP Vossen (Dec 19)
  • (no subject) Kumar, Manoj (Dec 22)
• I need sensor volunteers Brad dev account (Oct 08)
• ICMP / drop. Rudi Starcevic (Oct 09)
  • Re: ICMP / drop. Ralf Spenneberg (Oct 09)
    • Re: ICMP / drop. Rudi Starcevic (Oct 09)
      • Re: ICMP / drop. Edin Dizdarevic (Oct 09)
      • Re: ICMP / drop. Rudi Starcevic (Oct 09)
      • Re: ICMP / drop. Edin Dizdarevic (Oct 09)
• Snort on Windows : system error 1067 thelastcowboy (Oct 09)
  • RE: Snort on Windows : system error 1067 Michael Steele (Oct 09)
• Rule to exclude a specific IP in Snort Juan M. Rivera (Oct 09)
  • EXTERNAL_NET definition in Snort Jukka Juslin (Oct 09)
    • Re: EXTERNAL_NET definition in Snort Erek Adams (Oct 09)
  • Re: Rule to exclude a specific IP in Snort Chris Green (Oct 09)
    • RE: Rule to exclude a specific IP in Snort Juan M. Rivera (Oct 09)
      • Re: Rule to exclude a specific IP in Snort Chris Green (Oct 09)
    • RE: Rule to exclude a specific IP in Snort Juan M. Rivera (Oct 14)
  • <Possible follow-ups>
  • RE: Rule to exclude a specific IP in Snort Hutchinson, Andrew (Oct 09)
    • RE: Rule to exclude a specific IP in Snort Jason (Oct 09)
  • RE: Rule to exclude a specific IP in Snort Grime, Richard S (Oct 09)
  • FW: Rule to exclude a specific IP in Snort grant (Oct 16)
    • Re: FW: Rule to exclude a specific IP in Snort Erek Adams (Oct 16)
  • Re: Rule to exclude a specific IP in Snort Nordwall, Douglas J (Oct 20)
• RE: EXTERNAL_NET definition in Snort Grime, Richard S (Oct 09)
• Very few Snort alerts mailinglist (Oct 09)
• snort reports in english tempus (Oct 09)
• Naming the Sensors in a multiple interface sensor James Hunter (Oct 09)
  • <Possible follow-ups>
  • Naming the Sensors in a multiple interface sensor Marc Quibell (Oct 09)
    • Re: Naming the Sensors in a multiple interface sensor Erek Adams (Oct 09)
      • Re: Naming the Sensors in a multiple interface sensor James Hunter (Oct 09)
• Why does log_acid_db not work? Chhabria, Kavita - Apogent (Oct 09)
• Skype rule Marc Quibell (Oct 09)
• Snort Setup Scenario - Suggestions Naman Latif (Oct 09)
  • <Possible follow-ups>
  • Re: Snort Setup Scenario - Suggestions Josh Berry (Oct 09)
  • RE: Snort Setup Scenario - Suggestions Naman Latif (Oct 09)
    • RE: Snort Setup Scenario - Suggestions Josh Berry (Oct 09)
• Sample config Igor Kotlovskiy (Oct 09)
• Mac Adresses in Acid Screens Juan M. Rivera (Oct 09)
  • Re: Mac Adresses in Acid Screens Demetri Mouratis (Oct 10)
    • Re: Mac Adresses in Acid Screens Milo Velimirovic (Oct 10)
    • Re: Mac Adresses in Acid Screens Jeff Nathan (Oct 10)
  • <Possible follow-ups>
  • RE: Mac Adresses in Acid Screens Schmehl, Paul L (Oct 10)
    • RE: Mac Adresses in Acid Screens Demetri Mouratis (Oct 10)
      • Re: Mac Adresses in Acid Screens Stephen W. Thompson (Oct 10)
  • RE: Mac Adresses in Acid Screens Schmehl, Paul L (Oct 10)
• Announcement: Visual Intrusion Analyzer (Beta Release) Eric Knight (Oct 09)
  • Re: Announcement: Visual Intrusion Analyzer (Beta Release) Scot Scot (Oct 10)
    • RE: Announcement: Visual Intrusion Analyzer (Beta Release) LE (Oct 10)
      • RE: Announcement: Visual Intrusion Analyzer (Beta Release) Michael Steele (Oct 10)
      • RE: Announcement: Visual Intrusion Analyzer (Beta Release) dave kleiman (Oct 10)
• How to get an answer to your question(s) Erek Adams (Oct 09)
  • Re: How to get an answer to your question(s) David Alonso De La Vega Tapage (Oct 10)
  • <Possible follow-ups>
  • Re: How to get an answer to your question(s) JP Vossen (Oct 10)
  • How to get an answer to your question(s) Jeff Nathan (Oct 24)
    • Re: How to get an answer to your question(s) Matt Kettler (Oct 24)
      • Re: How to get an answer to your question(s) Erek Adams (Oct 24)
• Snort + Apache modules. Rudi Starcevic (Oct 10)
• snort 2.0 architecture Angelo . Fabiano (Oct 10)
• error starting snort!! yoki tyas (Oct 10)
  • Re: error starting snort!! Matt Kettler (Oct 10)
  • Re: error starting snort!! Erek Adams (Oct 10)
• Problem with web-iis rules Yan Zhai (Oct 10)
  • Re: Problem with web-iis rules Matt Kettler (Oct 10)
  • Re: Problem with web-iis rules Erek Adams (Oct 10)
  • Re: Problem with web-iis rules Josh Berry (Oct 10)
  • Re: Problem with web-iis rules Josh Berry (Oct 10)
  • <Possible follow-ups>
  • RE: Problem with web-iis rules snort-ml (Oct 10)
    • RE: Problem with web-iis rules Yan Zhai (Oct 11)
  • Re: Problem with web-iis rules Yan Zhai (Oct 11)
  • RE: Problem with web-iis rules Alex Alborzfard (Oct 13)
• Snort-2.0.2-5.src.rpm bad MD5 digest Harry Hoffman (Oct 10)
  • Re: Snort-2.0.2-5.src.rpm bad MD5 digest Daniel Wittenberg (Oct 10)
• Alerts or log files, which is better? John Creegan (Oct 10)
• Testing My Snort DIDS Aaron Babalola (Oct 10)
  • Re: Testing My Snort DIDS twig les (Oct 10)
• Visual Intrusion Analyzer Bugs, feedback, and a little background. Eric Knight (Oct 11)
  • Re: Visual Intrusion Analyzer Bugs, feedback, and a little background. Jeff Nathan (Oct 11)
    • Re: Visual Intrusion Analyzer Bugs, feedback, and a little background. Eric Knight (Oct 11)
  • <Possible follow-ups>
  • RE: Visual Intrusion Analyzer Bugs, feedback, and a little background. adam.w.hogan (Oct 13)
• ADSL and SNORT GRL (Oct 11)
  • Re: ADSL and SNORT Matt Kettler (Oct 13)
• Same config, FreeBSD vs OpenBSD, WAY different results Jim Brown (Oct 12)
  • Re: Same config, FreeBSD vs OpenBSD, WAY different results twig les (Oct 12)
  • Re: Same config, FreeBSD vs OpenBSD, WAY different results Erek Adams (Oct 12)
    • Re: Same config, FreeBSD vs OpenBSD, WAY different results Jim Brown (Oct 12)
      • RE: Same config, FreeBSD vs OpenBSD, WAY different results Michael Steele (Oct 12)
      • Re: Same config, FreeBSD vs OpenBSD, WAY different results Stephen W. Thompson (Oct 12)
  • Re: Same config, FreeBSD vs OpenBSD, WAY different results Jim Brown (Oct 13)
  • <Possible follow-ups>
  • Re: Same config, FreeBSD vs OpenBSD, WAY different results scheidell (Oct 13)
    • Re: Same config, FreeBSD vs OpenBSD, WAY different results Josh Berry (Oct 13)
• Not Picking up Much WHY "I am pulling out my hair" Elijah Savage (Oct 12)
  • Re: Not Picking up Much WHY "I am pulling out my hair" Patrick Harper (Oct 12)
• Eric Van den Bossche is out of the office. Eric Van den Bossche (Oct 13)
• RE: Not Picking up Much WHY "I am pulling out myhair" Elijah Savage (Oct 13)
  • Message not available
    • RE: Not Picking up Much WHY "I am pulling out myhair" esavage (Oct 13)
      • RE: Not Picking up Much WHY "I am pulling out myhair" esavage (Oct 13)
• Re: Same config, FreeBSD vs OpenBSD, WAY different results Marc Quibell (Oct 13)
  • <Possible follow-ups>
  • Re: Same config, FreeBSD vs OpenBSD, WAY different results Marc Quibell (Oct 14)
• Snortcenter Shawn Cannon (Oct 13)
  • Re: Snortcenter Roberto Bosticardo (Oct 13)
  • <Possible follow-ups>
  • snortcenter SWIT (Nov 19)
• snort on linux and acid on windows ravath k (Oct 13)
  • RE: snort on linux and acid on windows Michael Steele (Oct 13)
  • <Possible follow-ups>
  • RE: snort on linux and acid on windows Zach Forsyth (Oct 15)
• Snort rule for AIM fire transfers? Michael Janke (Oct 13)
• Shadow/Snort IDS version 3.2 with ACID Guy Bruneau (Oct 13)
• RE: Not Picking up Much WHY "I am pulling out myhair" John Creegan (Oct 13)
• Bug in 2.02 found getting this SMB rule to work Jason Haar (Oct 13)
• Changing Alert Order Thiago Mello (Oct 13)
• RE: Not Picking up Much WHY "I am pulling outmyhair" Elijah Savage (Oct 13)
• VIA and suggestions... Eric Knight (Oct 14)
• Snort / Barnyard error. Rudi Starcevic (Oct 14)
  • Re: Snort / Barnyard error. Bamm Visscher (Oct 14)
• AW: Snort / Barnyard error. Jochen Vogel (Oct 14)
  • <Possible follow-ups>
  • AW: Snort / Barnyard error. Jochen Vogel (Oct 14)
    • Re: AW: Snort / Barnyard error. Rudi Starcevic (Oct 14)
• winsnort : how to update rules ? thelastcowboy (Oct 14)
• snortinline doesn´t log payload Jochen Vogel (Oct 14)
• Snort Logs Martin Jr., D. Michael (Oct 14)
  • <Possible follow-ups>
  • RE: Snort Logs Martin Jr., D. Michael (Oct 14)
    • Re: RE: Snort Logs Nick Oliver (Oct 14)
  • RE: Snort Logs grant (Oct 17)
• Flushing the data from the MySQL database Kaplan, Andrew H. (Oct 14)
  • <Possible follow-ups>
  • RE: Flushing the data from the MySQL database Schmehl, Paul L (Oct 14)
    • RE: Flushing the data from the MySQL database Michael Parkinson (Oct 14)
  • Re: Flushing the data from the MySQL database Josh Berry (Oct 14)
  • RE: Flushing the data from the MySQL database Josh Berry (Oct 14)
• Recognize this? JJ (Oct 14)
  • <Possible follow-ups>
  • Re: Recognize this? James Nonya (Oct 14)
  • Re: Recognize this? JJ (Oct 14)
• tippingpoint Kerry Cox (Oct 14)
  • Re: tippingpoint Sean Perry (Oct 14)
    • Re: tippingpoint Josh Berry (Oct 14)
      • RE: tippingpoint Brian Laing (Oct 15)
      • Re: tippingpoint Jeff Nathan (Oct 15)
  • RE: tippingpoint Geoff (Oct 14)
  • <Possible follow-ups>
  • RE: tippingpoint Rich Stryker (Oct 14)
  • Re: tippingpoint Josh Berry (Oct 14)
    • Re: t(r)ippingpoint? Jason (Oct 14)
      • Re: t(r)ippingpoint? Josh Berry (Oct 14)
  • RE: tippingpoint Rich Stryker (Oct 16)
    • QUASHING THREAD: Re: tippingpoint Jeff Nathan (Oct 16)
  • RE: tippingpoint Marc Quibell (Oct 16)
  • RE: tippingpoint Gross Barry D. (Oct 16)
• byte_test and Snortcenter John Hally (Oct 14)
  • RE: byte_test and Snortcenter snort (Oct 16)
    • [Snort-Users] Patching Snort with SnortSAM Daniél Haslinger (Oct 19)
      • script to extract payload info from mysql snort table samwun (Oct 19)
      • error in running SnortSnarf samwun (Oct 19)
      • Re: [Snort-Users] Patching Snort with SnortSAM Frank Knobbe (Oct 19)
      • how to populate snort payload data to MySQL? samwun (Oct 22)
      • RE: how to populate snort payload data to MySQL? Jeff Dell (Oct 22)
      • RE: how to populate snort payload data to MySQL? samwun (Oct 22)
      • how to convert payload data from MySQL data table to tcpdump formated data? samwun (Oct 22)
      • Re: how to convert payload data from MySQL data table to tcpdump formated data? Erek Adams (Oct 22)
      • Re: how to convert payload data from MySQL data table to tcpdump formated data? Sam Wun (Oct 23)
      • Distributed tcpdump output log file from snort. sam (Oct 23)
      • Re: how to convert payload data from MySQL data table to tcpdump formated data? Martin Olsson (Oct 24)
      • Re: how to convert payload data from MySQL data table to tcpdump formated data? Martin Olsson (Oct 23)
      • RE: how to convert payload data from MySQL data table to tcpdump formated data? samwun (Oct 23)
      • RE: how to convert payload data from MySQL data table to tcpdump formated data? Jeff Dell (Oct 23)
      • RE: how to convert payload data from MySQL data table to tcpdump formated data? samwun (Oct 23)
      • RE: how to convert payload data from MySQL data table to tcpdump formated data? samwun (Oct 23)
      • Re: how to populate snort payload data to MySQL? Kenneth G. Arnold (Oct 23)
      • RE: how to populate snort payload data to MySQL? samwun (Oct 22)
      • RE: how to populate snort payload data to MySQL? Kenneth G. Arnold (Oct 23)
      • snort tcpdump binary file mirroing over network. samwun (Oct 24)
      • Re: snort tcpdump binary file mirroing over network. Erek Adams (Oct 24)
      • RE: snort tcpdump binary file mirroing over network. samwun (Oct 24)
      • Re: snort tcpdump binary file mirroing over network. Jason Haar (Oct 25)
      • Re: snort tcpdump binary file mirroing over network. Chris Green (Oct 24)
• Time and Date off Elijah Savage (Oct 14)
  • <Possible follow-ups>
  • Re: Time and Date off John Creegan (Oct 14)
  • RE: Time and Date off Elijah Savage (Oct 14)
• snortsnarf grant (Oct 14)
  • RE: SnortSnarf Michael Steele (Oct 14)
  • <Possible follow-ups>
  • SnortSnarf Martin Jr., D. Michael (Oct 16)
    • RE: SnortSnarf Michael Steele (Oct 16)
  • RE: SnortSnarf grant (Oct 16)
  • RE: SnortSnarf Martin Jr., D. Michael (Oct 16)
  • RE: SnortSnarf grant (Oct 16)
  • RE: SnortSnarf grant (Oct 18)
• Non-content matching. OTN before RTN? Jaykumar Gosar (Oct 14)
• Barnyard HTML output error Rudi Starcevic (Oct 15)
• NIDS Packet Capture Problem Shishir Tejpal (Oct 15)
  • <Possible follow-ups>
  • NIDS Packet Capture Problem Shishir Tejpal (Oct 15)
    • RE: NIDS Packet Capture Problem Gordon Cunningham (Oct 15)
• How can i see the payload of extra-packet captured by tag option ???? m.massarenti () cineca it (Oct 15)
• Re: Re: [Snort-devel] IDS vs IPS Dragos Ruiu (Oct 15)
• Home nets and pruning my alerts ccidsh-snort . org (Oct 15)
• Using Snort as IDS + packet logger Damiano Bolzoni (Oct 15)
  • Re: Using Snort as IDS + packet logger Scot Scot (Oct 16)
  • <Possible follow-ups>
  • RE: Using Snort as IDS + packet logger Richard Bejtlich (Oct 15)
  • RE: Using Snort as IDS + packet logger grant (Oct 16)
• RE: SCAN UPnP service discover attempt Schmehl, Paul L (Oct 15)
  • <Possible follow-ups>
  • SCAN UPnP service discover attempt Martin Jr., D. Michael (Oct 15)
  • RE: SCAN UPnP service discover attempt Philip Davidson (Oct 16)
  • Re: SCAN UPnP service discover attempt Michael . Mulholland (Dec 30)
  • RE: Re: SCAN UPnP service discover attempt Brian F. Vaughan (Dec 30)
  • Re: SCAN UPnP service discover attempt Michael . Mulholland (Dec 30)
• Don't report and rules retrieval Martin Jr., D. Michael (Oct 15)
  • Re: Don't report and rules retrieval Jeff Pricher (Oct 15)
    • Rule for MS03-046 ? Muenz, Michael (Oct 16)
• Windows Event Log & alert.ids grant (Oct 16)
  • Re: Windows Event Log & alert.ids Scot Scot (Oct 16)
  • <Possible follow-ups>
  • Windows Event Log & alert.ids grant (Oct 16)
  • RE: Windows Event Log & alert.ids grant (Oct 16)
    • Re: Windows Event Log & alert.ids Scot Scot (Oct 18)
• Can't Start Snort - ERROR: No netmask specified for home network! Ross Bram (Oct 16)
• where I configure my rules ? חואן (Oct 16)
  • Re: where I configure my rules ? Erek Adams (Oct 16)
    • Re: where I configure my rules ? John Sage (Oct 17)
• Monitor multiple VLANs Martin Jr., D. Michael (Oct 16)
  • Re: Monitor multiple VLANs Chris Green (Oct 16)
  • RE: Monitor multiple VLANs Jake Seitz (Oct 16)
  • RE: Monitor multiple VLANs Gordon Cunningham (Oct 16)
  • <Possible follow-ups>
  • RE: Monitor multiple VLANs Martin Jr., D. Michael (Oct 16)
  • RE: Monitor multiple VLANs Jeremy Junginger (Oct 16)
  • RE: Monitor multiple VLANs Douglas McCrea (Oct 16)
  • RE: Monitor multiple VLANs Martin Jr., D. Michael (Oct 16)
• quick question Pari Sahai (Oct 16)
  • RE: quick question kanwal (Oct 16)
• send scan.log to remote Log-Host Thomas Bechtold (Oct 16)
• RE: Snort -> Mysql formatting IP addresses Jacob Roberts (Oct 16)
  • <Possible follow-ups>
  • RE: Snort -> Mysql formatting IP addresses Nelson, Ben (Oct 16)
  • Snort -> Mysql formatting IP addresses FWAdmin (Oct 16)
  • RE: Snort -> Mysql formatting IP addresses Nelson, Ben (Oct 16)
  • RE: Snort -> Mysql formatting IP addresses Dusty Hall (Oct 16)
  • RE: Snort -> Mysql formatting IP addresses Hutchinson, Andrew (Oct 16)
  • RE: Snort -> Mysql formatting IP addresses Steve Halligan (Oct 17)
• Snort Startup Erro - "libmysqlclient.so.12 not found" O'Flynn, Derek (Oct 16)
  • Re: Snort Startup Erro - "libmysqlclient.so.12 not found" Erek Adams (Oct 16)
• Can Snort do this? Sheahan, Paul (Oct 16)
  • Re: Can Snort do this? Erek Adams (Oct 16)
    • Re: Can Snort do this? guillaume.rix (Oct 17)
    • Re: Can Snort do this? Guillaume . Rix (Oct 17)
    • Re: Can Snort do this? Chris Green (Oct 20)
      • how to log payload data to MySQL and /var/log/snort/ Sam Wun (Oct 20)
• Re: Snort-users digest, Vol 1 #3643 - 11 msgs Marc Quibell (Oct 16)
• Snort Success!!! grant (Oct 16)
  • <Possible follow-ups>
  • Re: Snort Success!!! Shawn Truax (Oct 23)
• RE: Snort Startup Erro - "libmysqlclient.so.12 not found" O'Flynn, Derek (Oct 16)
• Re: tippingpoint] Geoff (Oct 16)
  • Re: tippingpoint] John Sage (Oct 17)
    • Re: tippingpoint] Frank Knobbe (Oct 17)
    • Re: tippingpoint] Gary Flynn (Oct 17)
    • Message not available
      • Re: tippingpoint] John Sage (Oct 19)
  • Re: tippingpoint] Michael Sierchio (Oct 17)
    • Re: tippingpoint] Geoff (Oct 17)
  • <Possible follow-ups>
  • FW: tippingpoint] Geoff Poer (Oct 20)
• What is snort doing to the packets Steve Bagwell (Oct 16)
  • Re: What is snort doing to the packets John Sage (Oct 17)
  • <Possible follow-ups>
  • What is snort doing to the packets Bagwell, Steve (Oct 17)
  • What is snort doing to the packets Bagwell, Steve (Oct 17)
• snort.conf file.. f z (Oct 17)
  • Re: snort.conf file.. Matt Kettler (Oct 17)
• No portscan alerts shown in acid. Peters, Michael D. (Oct 17)
  • <Possible follow-ups>
  • Re: No portscan alerts shown in acid. John Creegan (Oct 18)
• Snort and SSL Sheahan, Paul (Oct 17)
  • Re: Snort and SSL Rudi Starcevic (Oct 17)
• sid:663; rev:6 false alerts/bug Michael Sierchio (Oct 17)
• Re: tippingpoint]] Geoff (Oct 17)
• [Fwd: Re: tippingpoint] Geoff (Oct 17)
  • Re: [Fwd: Re: tippingpoint] Josh Berry (Oct 17)
    • Re: [Fwd: Re: tippingpoint] Geoff (Oct 17)
      • Re: [Fwd: Re: tippingpoint] Gary Flynn (Oct 17)
  • <Possible follow-ups>
  • RE: [Fwd: Re: tippingpoint] Bob Walder (Oct 17)
• New to Snort wallenpb (Oct 17)
• Testing tools Alan Holmes (Oct 17)
  • Re: Testing tools Demetri Mouratis (Oct 18)
    • RE: Testing tools Matt Foster (Oct 20)
• fatal error חואן (Oct 18)
  • Re: fatal error Josh Berry (Oct 18)
  • problem with snortcenter samwun (Oct 19)
    • Re: problem with snortcenter Irwan Hadi (Oct 19)
  • Missing of application/data link layer capture. samwun (Oct 19)
• how can one tell if snort works חואן (Oct 18)
  • Re: how can one tell if snort works Josh Berry (Oct 19)
  • Re: how can one tell if snort works Nick Oliver (Oct 19)
• w ant to use Mrtg with snort חואן (Oct 18)
• Compilation of Snort 2.0.2 in debug mode fails Mark Cooper (HP) (Oct 19)
  • Re: Compilation of Snort 2.0.2 in debug mode fails Chris Reid (Oct 19)
  • <Possible follow-ups>
  • Compilation of Snort 2.0.2 in debug mode fails Mark Cooper (Oct 20)
  • Compilation of Snort 2.0.2 in debug mode fails Mark Cooper (Oct 20)
• No External Hits/Proxy Server Required? Tim Rohrer (Oct 19)
• L7 protocol analysis and snort ramesh neelmegh (Oct 19)
• Spade plugin Alexey Kuzmenko (Oct 20)
• Spade logs Alexey Kuzmenko (Oct 20)
• snort and mysql socket error Dr. EDV (Oct 20)
  • <Possible follow-ups>
  • Re: snort and mysql socket error John Creegan (Oct 20)
• Span Port to Fiber Tap Problems Dusty Hall (Oct 20)
  • <Possible follow-ups>
  • RE: Span Port to Fiber Tap Problems larosa, vjay (Oct 20)
  • Re: Span Port to Fiber Tap Problems Shawn Truax (Oct 23)
  • RE: Span Port to Fiber Tap Problems larosa, vjay (Oct 23)
  • RE: Span Port to Fiber Tap Problems Dusty Hall (Oct 23)
    • Re: Span Port to Fiber Tap Problems Jeff Nathan (Oct 25)
• where is see snort logs ? חואן (Oct 20)
  • Re: where is see snort logs ? Matt Kettler (Oct 20)
• Updated snort.server script Jeff Nathan (Oct 20)
• Newbie Question - Snort on Windows Joan L. Ackerman (Oct 21)
  • Message not available
    • Re: Newbie Question - Snort on Windows Matt Kettler (Oct 21)
• Managed Snort/IDS? Ryan Finnesey (Oct 21)
  • RE: Managed Snort/IDS? Gordon Cunningham (Oct 21)
  • <Possible follow-ups>
  • RE: Managed Snort/IDS? TPanaitescu (Oct 21)
  • RE: Managed Snort/IDS? Ryan Finnesey (Oct 28)
• SNMP Support in FreeBSD Keith Long (Oct 21)
  • Re: SNMP Support in FreeBSD Michael Sierchio (Oct 21)
  • Re: SNMP Support in FreeBSD Alexey Kuzmenko (Oct 24)
  • <Possible follow-ups>
  • SNMP Support in FreeBSD Keith Long (Oct 21)
  • RE: SNMP Support in FreeBSD Keith Long (Oct 21)
    • Re: SNMP Support in FreeBSD Michael Sierchio (Oct 21)
      • RE: SNMP Support in FreeBSD Keith Long (Oct 21)
      • Re: SNMP Support in FreeBSD Michael Sierchio (Oct 21)
      • Re: SNMP Support in FreeBSD Chris Green (Oct 22)
  • RE: SNMP Support in FreeBSD Keith Long (Oct 22)
    • RE: SNMP Support in FreeBSD twig les (Oct 22)
      • RE: SNMP Support in FreeBSD Erek Adams (Oct 22)
      • RE: SNMP Support in FreeBSD Martin Olsson (Oct 23)
  • RE: SNMP Support in FreeBSD Keith Long (Oct 24)
    • Re: SNMP Support in FreeBSD Michael Sierchio (Oct 24)
  • RE: SNMP Support in FreeBSD Keith Long (Oct 25)
• snort + freebsd tuning John (Oct 21)
  • Re: snort + freebsd tuning Michael Sierchio (Oct 21)
  • <Possible follow-ups>
  • Re: snort + freebsd tuning Nigel Houghton (Oct 28)
    • Re: snort + freebsd tuning Nigel Houghton (Oct 28)
• Lots of outgoing portscans Richard Gaywood (Oct 22)
  • Re: Lots of outgoing portscans Richard Gaywood (Oct 22)
  • Re: Lots of outgoing portscans Matt Kettler (Oct 22)
• MS03-043 Jeremy Junginger (Oct 22)
  • <Possible follow-ups>
  • RE: MS03-043 Adams, Samuel (contractor) (Oct 25)
• Same alerts generation hlima (Oct 22)
  • <Possible follow-ups>
  • Same alerts generation hlima (Oct 25)
• Problem: Unknown ClassType Cluett, Russell (Oct 22)
  • Re: Problem: Unknown ClassType Jeffrey Pricher (Oct 22)
  • <Possible follow-ups>
  • RE: Problem: Unknown ClassType Schmehl, Paul L (Oct 22)
• New rules keyword error Marc Quibell (Oct 22)
  • Re: New rules keyword error Erek Adams (Oct 22)
  • <Possible follow-ups>
  • Re: New rules keyword error Marc Quibell (Oct 22)
    • Re: New rules keyword error Erek Adams (Oct 22)
  • Re: New rules keyword error Marc Quibell (Oct 22)
  • Re: New rules keyword error Marc Quibell (Oct 23)
    • Re: New rules keyword error Frank Knobbe (Oct 23)
      • Re: New rules keyword error Josh Berry (Oct 28)
  • Re: New rules keyword error John Creegan (Oct 23)
    • Re: New rules keyword error Andreas Östling (Oct 23)
      • Re: New rules keyword error Jason Haar (Oct 24)
    • Re: New rules keyword error Chris Green (Oct 24)
  • Re: New rules keyword error John Creegan (Oct 23)
    • Re: New rules keyword error Jeff Nathan (Oct 25)
  • Re: New rules keyword error Marc Quibell (Oct 24)
  • Re: New rules keyword error Marc Quibell (Oct 24)
    • Re: New rules keyword error Jeff Nathan (Oct 24)
  • Re: New rules keyword error Marc Quibell (Oct 24)
    • Re: New rules keyword error Chris Green (Oct 24)
• Re: Content of Snort-users digest, Vol 1 #3660 Jay Moloo (Oct 22)
• Program that reads unified log format natively Ben Nelson (Oct 22)
  • <Possible follow-ups>
  • RE: Program that reads unified log format natively Williams Jon (Oct 24)
    • RE: Program that reads unified log format natively Erek Adams (Oct 24)
      • Re: Program that reads unified log format natively Ben Nelson (Oct 29)
    • Re: Program that reads unified log format natively Bamm Visscher (Oct 25)
    • Re: Program that reads unified log format natively Chris Green (Oct 25)
• NETBIOS nimda.eml Paul Lane (Oct 22)
  • Re: NETBIOS nimda.eml Erek Adams (Oct 22)
  • Re: NETBIOS nimda.eml Jason Haar (Oct 22)
• FW: [Snort-devel] New code (and building) [continued... ] Kreimendahl, Chad J (Oct 22)
• snort and sflow? shanks (Oct 22)
  • Re: snort and sflow? Erek Adams (Oct 22)
    • Re: snort and sflow? shanks (Oct 22)
  • <Possible follow-ups>
  • RE: snort and sflow? Kim Wall (Oct 22)
• Snort with Mysql Xiaoxu Huang (Oct 22)
  • Re: Snort with Mysql Erek Adams (Oct 22)
  • <Possible follow-ups>
  • Snort with Mysql Xiaoxu Huang (Oct 28)
• Alerts timestamp Ramon Barquier (Oct 22)
• snort ids dfd f z (Oct 22)
  • <Possible follow-ups>
  • snort ids dfd f z (Oct 23)
  • snort IDS DFD f z (Oct 23)
  • Re: snort IDS DFD Shawn Truax (Oct 23)
• Re: problem with snortcenter Shawn Truax (Oct 23)
• Fwd: Troubles With Multiple Sensors Tim Rohrer (Oct 23)
  • <Possible follow-ups>
  • Troubles With Multiple Sensors Tim Rohrer (Oct 24)
    • Re: Troubles With Multiple Sensors Erek Adams (Oct 24)
      • Re: Troubles With Multiple Sensors Tim Rohrer (Oct 25)
  • Re: Troubles With Multiple Sensors Shawn Truax (Oct 24)
    • Re: Troubles With Multiple Sensors Erek Adams (Oct 24)
• Compiling Snort Statically Josh Berry (Oct 23)
  • <Possible follow-ups>
  • Compiling Snort Statically Josh Berry (Oct 28)
• Snort on PPP Adapter / Win32 Fernsebner Christian (Oct 24)
• rules with flow:established not working Ed Callahan (Oct 24)
  • Re: rules with flow:established not working Erek Adams (Oct 24)
    • RE: rules with flow:established not working Ed Callahan (Oct 24)
      • RE: rules with flow:established not working Erek Adams (Oct 24)
      • RE: rules with flow:established not working Ed Callahan (Oct 24)
  • <Possible follow-ups>
  • RE: rules with flow:established not working Schmehl, Paul L (Oct 24)
    • RE: rules with flow:established not working Ed Callahan (Oct 24)
    • RE: rules with flow:established not working Erek Adams (Oct 24)
      • RE: rules with flow:established not working Ed Callahan (Oct 25)
      • RE: rules with flow:established not working Paul Schmehl (Oct 25)
• no payload on ppp0 Jochen Vogel (Oct 24)
  • Re: no payload on ppp0 Erek Adams (Oct 24)
    • AW: no payload on ppp0 Jo (Oct 25)
• Re: Parameters of Computer with 1G or 2x1G Ethenet NIC Philip Nedev (Oct 24)
• AW: Program that reads unified log format natively Jochen Vogel (Oct 24)
• Windows Snort Users Martin Jr., D. Michael (Oct 24)
  • RE: Windows Snort Users Michael Steele (Oct 25)
• Is it really a HUB? Petriz, Pablo (Oct 24)
  • Re: Is it really a HUB? Craig Paterson (Oct 24)
    • Re: Is it really a HUB? Jason Haar (Oct 25)
      • Re: Is it really a HUB? Rich Adamson (Oct 25)
    • Re: Is it really a HUB? Mike Cojocea (Oct 27)
  • Re: Is it really a HUB? Kristofer T. Karas (Oct 27)
  • <Possible follow-ups>
  • Re: Is it really a HUB? Marc Quibell (Oct 28)
    • Re: Is it really a HUB? Kristofer T. Karas (Oct 28)
      • Re: Is it really a HUB? Darryl Luff (Oct 28)
      • Re: Is it really a HUB? Kristofer T. Karas (Oct 29)
  • Re: Is it really a HUB? Marc Quibell (Oct 28)
  • RE: Is it really a HUB? Potts, Ross A. (Oct 29)
  • Re: Is it really a HUB? Petriz, Pablo (Nov 26)
    • Re: Is it really a HUB? Matt Kettler (Nov 26)
      • Re: Is it really a HUB? kenw (Nov 27)
      • Re: Is it really a HUB? Matt Kettler (Nov 28)
      • Re: Is it really a HUB? kenw (Nov 28)
      • Re: Is it really a HUB? Matt Kettler (Nov 28)
      • Re: Is it really a HUB? kenw (Nov 28)
  • RE: Is it really a HUB? bmcdowell (Nov 28)
• snort DB error.... f z (Oct 24)
  • Re: snort DB error.... Ralf Spenneberg (Oct 25)
  • <Possible follow-ups>
  • RE: snort DB error.... Bright, Mark IT2 (Oct 27)
  • Re: snort DB error.... Ralf Spenneberg (Oct 29)
• flow:established not working Ed Callahan (Oct 24)
• interesting observation on snort logging! Anyone else.. hallian hallian (Oct 24)
• Same alerts Henrique Lima (Oct 24)
• Request: New sections in snort-sid-template.txt Martin Olsson (Oct 24)
• RE: snort tcpdump binary file mirroing overnetwork. Shawn Truax (Oct 25)
  • Re: snort tcpdump binary file mirroing overnetwork. Michael Sierchio (Oct 25)
  • <Possible follow-ups>
  • RE: snort tcpdump binary file mirroing overnetwork. Donofrio, Lewis (Oct 29)
  • RE: snort tcpdump binary file mirroing overnetwork. Keith Long (Oct 29)
  • RE: snort tcpdump binary file mirroing overnetwork. samwun (Nov 02)
• Re: AW: no payload on ppp0 Shawn Truax (Oct 25)
  • AW: AW: no payload on ppp0 Jo (Oct 26)
• Redundant alerts in ACID ramesh naidu (Oct 25)
• Problem with MSSQL and ACID ramesh naidu (Oct 25)
• demarc/puresecure plugins? Ernie Lim (Oct 25)
  • <Possible follow-ups>
  • demarc/puresecure plugins? Ernie Lim (Oct 28)
• perfmonitor Erwin Van de Velde (Oct 25)
  • Re: perfmonitor Edin Dizdarevic (Oct 26)
• Snort on Windows - Help Rajneel.Dhotre (Oct 25)
  • RE: Snort on Windows - Help Michael Steele (Oct 25)
• compiling snort on windows aditya kilaru (Oct 25)
• Dropping packets why? Elijah Savage (Oct 25)
  • Message not available
    • Re: Dropping packets why? Matt Kettler (Oct 27)
  • Re: Dropping packets why? Edin Dizdarevic (Oct 27)
  • <Possible follow-ups>
  • RE: Dropping packets why? O'Flynn, Derek (Oct 27)
    • Re: Dropping packets why? Michael Sierchio (Oct 27)
      • copious (snort_decoder) WARNING: Not IPv4 datagram! Ernie Lim (Oct 27)
      • RE: copious (snort_decoder) WARNING: Not IPv4 datagram! Ernie Lim (Oct 27)
      • Re: copious (snort_decoder) WARNING: Not IPv4 datagram! Geoff (Oct 27)
  • RE: Dropping packets why? Elijah Savage (Oct 27)
    • Message not available
      • RE: Dropping packets why? Matt Kettler (Oct 27)
    • RE: Dropping packets why? Paul Schmehl (Oct 27)
  • RE: Dropping packets why? Elijah Savage (Oct 27)
  • RE: Dropping packets why? Elijah Savage (Oct 27)
  • RE: Dropping packets why? Elijah Savage (Oct 27)
• snort rules.... f z (Oct 25)
  • <Possible follow-ups>
  • Re: snort rules.... Shawn Truax (Oct 25)
• problem.... f z (Oct 25)
• Unknown datagram decoding problem Secureplay (Oct 26)
• Is this an attack in the making? Michael Esposito (Oct 26)
  • Re: Is this an attack in the making? Matt Kettler (Oct 27)
• OT: Spam Mail on List? Tim Rohrer (Oct 26)
  • <Possible follow-ups>
  • RE: OT: Spam Mail on List? Edwin Beekman (Oct 26)
    • Re: OT: Spam Mail on List? snort (Oct 27)
      • Re: OT: Spam Mail on List? Daniél Haslinger (Oct 27)
      • Re: OT: Spam Mail on List? Tim Rohrer (Oct 27)
      • Re: OT: Spam Mail on List? Jeff Nathan (Oct 27)
      • Re: OT: Spam Mail on List? Chris Green (Oct 27)
      • Re: OT: Spam Mail on List? Jeff Nathan (Oct 27)
      • Re: OT: Spam Mail on List? Chris Green (Oct 27)
    • RE: OT: Spam Mail on List? LE (Oct 27)
  • RE: OT: Spam Mail on List? Schmehl, Paul L (Oct 27)
  • RE: OT: Spam Mail on List? Marc Quibell (Oct 27)
  • RE: OT: Spam Mail on List? Ernie Lim (Oct 27)
    • Re: OT: Spam Mail on List? Tim Rohrer (Oct 27)
  • RE: OT: Spam Mail on List? Schmehl, Paul L (Oct 27)
  • RE: OT: Spam Mail on List? SRH-Lists (Oct 27)
  • Re: OT: Spam Mail on List? Marc Quibell (Oct 27)
    • Re: OT: Spam Mail on List? Chris Green (Oct 27)
• AW: AW: no payload on ppp0 Jochen Vogel (Oct 27)
• ACID alternative? Peters, Michael D. (Oct 27)
  • Re: ACID alternative? Bamm Visscher (Oct 27)
  • Re: ACID alternative? jon baer (Oct 27)
    • Re: ACID alternative? Josh Berry (Oct 27)
  • <Possible follow-ups>
  • Re: ACID alternative? John Creegan (Oct 27)
• Release of Snort Management Reports pieter claassen (Oct 27)
• Snort technical reviewers wanted Kerry Cox (Oct 27)
  • <Possible follow-ups>
  • Snort technical reviewers wanted Kerry Cox (Oct 28)
• Datagrams decoding problems Alexey Kuzmenko (Oct 27)
  • Re: Datagrams decoding problems Chris Green (Oct 27)
    • Re[2]: Datagrams decoding problems Alexey Kuzmenko (Oct 28)
• Re: [TCP and 53] Geoff (Oct 27)
• Re: Acid + Snort integration cc (Oct 27)
• snort and mysql cc (Oct 27)
• Snort Sensor RAJNEEL DHOTRE (Oct 27)
• Patch submission Secureplay (Oct 27)
  • Re: Patch submission Chris Green (Oct 28)
• Traffic flow RAJNEEL DHOTRE (Oct 28)
  • <Possible follow-ups>
  • RE: Traffic flow RAJNEEL DHOTRE (Oct 28)
• Problems with the ordering inside the rules Sergio Talens-Oliag (Oct 28)
  • Re: Problems with the ordering inside the rules Brian (Nov 06)
  • <Possible follow-ups>
  • RE: Problems with the ordering inside the rules Adams, Samuel (contractor) (Nov 06)
    • Re: Problems with the ordering inside the rules Sergio Talens-Oliag (Nov 07)
• Please help!! hlima (Oct 28)
  • Re: Please help!! Thiago Mello (Oct 28)
• strange port scan activity to tcp 18xxx? Vincent Chen (Oct 28)
• Re: ACID alternative Sleepy (Oct 28)
  • <Possible follow-ups>
  • Re: Re: ACID alternative Michael Scheidell (Oct 29)
• ACID Email alerts Krueger, Brian (Oct 28)
  • <Possible follow-ups>
  • ACID Email alerts Krueger, Brian (Oct 30)
  • RE: ACID Email alerts Peters, Michael D. (Oct 31)
  • RE: ACID Email alerts Schmehl, Paul L (Oct 31)
    • Re: ACID Email alerts Lane LiaBraaten (Oct 31)
      • Re: ACID Email alerts Ben Nelson (Oct 31)
• Database logging question Bob Fudge (Oct 28)
• Announcement: Alert Verification for Snort Christopher Kruegel (Oct 28)
• help required sharma krishna (Oct 28)
  • <Possible follow-ups>
  • help required sharma krishna (Oct 31)
• Snort install error finding mysql.h Cluett, Russell (Oct 28)
  • <Possible follow-ups>
  • Re: Snort install error finding mysql.h Perkins (Oct 28)
• Snort+Kismet James R. Frisky (Oct 28)
  • Re: Snort+Kismet Nordwall, Douglas J (Oct 28)
• technical reviewers Kerry Cox (Oct 28)
• Stealth sniffing and and bridging networks Watson, Ed (Oct 28)
  • <Possible follow-ups>
  • Stealth sniffing and and bridging networks Marc Quibell (Oct 28)
• Snort MySQL logging error... Bright, Mark IT2 (Oct 28)
  • RE: Snort MySQL logging error... Jeff Dell (Oct 28)
• ICMP w/payload of 1472 zeroes Michael Sierchio (Oct 28)
  • Re: ICMP w/payload of 1472 zeroes Mike Cojocea (Oct 28)
    • Re: ICMP w/payload of 1472 zeroes Michael Sierchio (Oct 28)
  • Re: ICMP w/payload of 1472 zeroes Michael Sierchio (Oct 31)
• Snort 2.0.2 and Oracle DB Runion, Matthew D (Oct 28)
  • Re: Snort 2.0.2 and Oracle DB Nerijus Krukauskas (Oct 29)
  • <Possible follow-ups>
  • RE: Snort 2.0.2 and Oracle DB Majwabu, Richard (Oct 29)
• ACID patch for portscan2??? Peters, Michael D. (Oct 28)
• Using snort for network stats? Michael Miller (Oct 28)
  • RE: Using snort for network stats? Jeff Dell (Oct 28)
  • Re: Using snort for network stats? Jeffrey Pricher (Oct 28)
  • <Possible follow-ups>
  • Re: Using snort for network stats? James Nonya (Oct 28)
  • RE: Using snort for network stats? DeBerry, Casey (Oct 28)
  • RE: Using snort for network stats? Snort (Oct 28)
• New Blaster variant? Bryan Oser (Oct 28)
  • Re: New Blaster variant? Jim Brown (Oct 28)
  • <Possible follow-ups>
  • RE: New Blaster variant? Security Admin (Oct 28)
    • Re: New Blaster variant? Jeff Kell (Oct 28)
• remote database logging Majwabu, Richard (Oct 28)
  • <Possible follow-ups>
  • remote database logging Majwabu, Richard (Oct 29)
• read snort payload data? JOHN XAVIOR (Oct 28)
• errors in my postgresql logs after running snortdb-extra.gz Jason Truong (Oct 28)
• Proposed Configuration Kaplan, Andrew H. (Oct 28)
• Installation Problem Aryan D (Oct 28)
  • Re: Installation Problem Ralf Spenneberg (Oct 29)
  • <Possible follow-ups>
  • Re: Installation Problem Aryan D (Oct 29)
  • Re: Installation Problem Aryan D (Oct 29)
  • Installation Problem Aryan D (Oct 30)
  • Installation Problem Aryan D (Oct 30)
• snort as network surveillance tool gsrao (Oct 28)
• Rule files commented out with Oinkmaster hlima (Oct 29)
  • Re: Rule files commented out with Oinkmaster Andreas Östling (Oct 29)
• ERROR: OpenPcap() FSM compilation failed: ?? James R. Frisky (Oct 29)
• Portscan log file consolidation. Peters, Michael D. (Oct 29)
  • Re: Portscan log file consolidation. Denny Page (Oct 29)
• RE: Spam:Re: New Blaster variant? Bryan Oser (Oct 29)
• Nachi false positives Martin Jr., D. Michael (Oct 29)
  • Re: Nachi false positives Mark Nipper (Oct 29)
  • Re: Nachi false positives Paul Schmehl (Oct 29)
  • <Possible follow-ups>
  • RE: Nachi false positives Martin Jr., D. Michael (Oct 30)
• Excluding particular IP address ranges from scans Kaplan, Andrew H. (Oct 29)
  • Re: Excluding particular IP address ranges from scans Ralf Spenneberg (Oct 29)
• HTTP Packet Capture Jim VanEtten (Oct 29)
  • Re: HTTP Packet Capture Mark Nipper (Oct 29)
  • Message not available
    • Re: HTTP Packet Capture Matt Kettler (Oct 29)
  • <Possible follow-ups>
  • RE: HTTP Packet Capture O'Flynn, Derek (Oct 29)
• Re: RE: BAD-TARFFIC Loopback traffic Frank Knobbe (Oct 29)
  • <Possible follow-ups>
  • Re: RE: BAD-TARFFIC Loopback traffic JP Vossen (Dec 20)
• RE: Excluding particular IP address ranges from sca ns Kaplan, Andrew H. (Oct 29)
• Problem to sniff 80, 110, 25 and 21 ports. giochi (Oct 29)
  • Re: Problem to sniff 80, 110, 25 and 21 ports. Matt Kettler (Oct 29)
    • Re: Problem to sniff 80, 110, 25 and 21 ports. giochi (Oct 29)
    • Re: Problem to sniff 80, 110, 25 and 21 ports. Mike Cojocea (Oct 29)
  • <Possible follow-ups>
  • Problem to sniff 80, 110, 25 and 21 ports. giochi (Oct 29)
  • RE: Problem to sniff 80, 110, 25 and 21 ports. O'Flynn, Derek (Oct 29)
• remote logging Majwabu, Richard (Oct 29)
  • Message not available
    • Re: remote logging Matt Kettler (Oct 29)
• generic bpf_rules_file Kaplan, Andrew H. (Oct 29)
  • <Possible follow-ups>
  • FW: generic bpf_rules_file Kaplan, Andrew H. (Oct 30)
  • generic bpf_rules_file Bernard Duclot (Nov 03)
• running oinkmaster - Error: unable to download..... Snortty (Oct 29)
  • Re: running oinkmaster - Error: unable to download..... Paul Schmehl (Oct 29)
  • Re: running oinkmaster - Error: unable to download..... Andreas Östling (Oct 30)
    • Re: running oinkmaster - Error: unable to download..... Snortty (Oct 30)
  • <Possible follow-ups>
  • Re: running oinkmaster - Error: unable to download..... Snortty (Oct 30)
  • RE: running oinkmaster - Error: unable to download..... Schmehl, Paul L (Oct 30)
    • RE: running oinkmaster - Error: unable to download..... Snortty (Oct 31)
• Preprocessor2 Mike Koponick (Oct 29)
  • Message not available
    • Re: Preprocessor2 Matt Kettler (Oct 29)
• Format of Snort logs? Daniel Bartlett (Oct 29)
  • <Possible follow-ups>
  • Format of Snort logs? Daniel Bartlett (Oct 29)
• RPM config dvid johnson (Oct 29)
  • Re: RPM config Matt Kettler (Oct 29)
  • Re: RPM config Daniel Wittenberg (Oct 29)
  • <Possible follow-ups>
  • RPM config JOHNSON DAVID R (Oct 30)
• Hot to see how many packets my snort is droping Philip Nedev (Oct 30)
  • Re: Hot to see how many packets my snort is droping Mark Nipper (Oct 30)
• Installation of Snort Sensor edmund . li (Oct 30)
  • Re: Installation of Snort Sensor edmund . li (Nov 02)
• ids + umts Roberto Bosticardo (Oct 30)
• /etc/passwd request increase Sheahan, Paul (Oct 30)
• perl script for snort keith greenhill (Oct 30)
• Snort Alerting Question ACiD (Oct 30)
• SANS Honeypot Webcast with Lance Spitzner Security Admin (Oct 30)
• CanSecWest/core04 Call For Papers Dragos Ruiu (Oct 30)
• Rogue DHCP servers Martin Jr., D. Michael (Oct 30)
  • Re: Rogue DHCP servers Bennett Todd (Oct 31)
  • <Possible follow-ups>
  • RE: Rogue DHCP servers Kaplan, Andrew H. (Oct 30)
  • RE: Rogue DHCP servers Martin Jr., D. Michael (Oct 30)
    • Re: Rogue DHCP servers Jason Haar (Oct 30)
  • RE: Rogue DHCP servers Kaplan, Andrew H. (Oct 31)
  • RE: Rogue DHCP servers Martin Jr., D. Michael (Oct 31)
    • RE: Rogue DHCP servers Gilbert Mendoza (Oct 31)
      • RE: Rogue DHCP servers Gilbert Mendoza (Oct 31)
    • Re: Rogue DHCP servers Jon Hart (Oct 31)
• sguil-0.3.0 Released Bamm Visscher (Oct 30)
• Snort-supported link-layer types Michael L. Artz (Oct 30)
  • Re: Snort-supported link-layer types Jamie Dahl (Oct 30)
  • Re: Snort-supported link-layer types Matt Kettler (Nov 03)
• Failed Snort Installation Stiles, Eric (Oct 30)
  • Re: Failed Snort Installation Patrick Harper (Nov 01)
• unsubscribe Marty Hauser (Oct 30)
• Unable to open rules file: reference.config or ./reference.config Fatal Error, Quitting.. David Durocher (Oct 31)
  • RE: Unable to open rules file: reference.config or ./reference.config Fatal Error, Quitting.. Michael Steele (Oct 31)
• Snort log format? Daniel Bartlett (Oct 31)
  • Re: Snort log format? Frank Knobbe (Oct 31)
• anyone have a good Swen sig Philip Davidson (Oct 31)
  • Re: [Snort-sigs] anyone have a good Swen sig Brian A Kee (Nov 03)
• Error making config file for PHP --with-mssql swith Majwabu, Richard (Oct 31)
• Snort Lance, Jeff (Oct 31)
  • Message not available
    • Re: Snort Matt Kettler (Oct 31)
• Snort bild with MSSQL support Majwabu, Richard (Oct 31)
  • <Possible follow-ups>
  • RE: Snort bild with MSSQL support Schmehl, Paul L (Oct 31)
  • RE: Snort bild with MSSQL support Majwabu, Richard (Nov 06)
• Spade/Spice and Snort? Mark . Schutzmann (Oct 31)
  • RE: Spade/Spice and Snort? Michael Steele (Nov 01)
  • <Possible follow-ups>
  • RE: Spade/Spice and Snort? Mark . Schutzmann (Nov 02)
    • Message not available
      • RE: Spade/Spice and Snort? Matt Kettler (Nov 03)
      • RE: Spade/Spice and Snort? Michael Steele (Nov 03)
  • RE: Spade/Spice and Snort? Mark . Schutzmann (Nov 03)
    • RE: Spade/Spice and Snort? Michael Steele (Nov 03)
      • RE: Spade/Spice and Snort? Matt Kettler (Nov 12)
• [UPGRADING from 1.8.6] GDHough (Nov 01)
  • RE: [UPGRADING from 1.8.6] Michael Steele (Nov 01)
    • Re: [UPGRADING from 1.8.6] GDHough (Nov 02)
  • Re: [UPGRADING from 1.8.6] Patrick Harper (Nov 01)
• Strategic Change at Silicon Defense.com Michael Steele (Nov 01)
  • <Possible follow-ups>
  • Strategic Change at Silicon Defense.com Michael Steele (Nov 03)
• TCP header length exceeds packet length Erik Nyman (Nov 03)
  • Re: TCP header length exceeds packet length Phil Wood (Nov 03)
  • <Possible follow-ups>
  • TCP header length exceeds packet length Erik Nyman (Nov 03)
    • Re: TCP header length exceeds packet length mouss (Nov 03)
• Snort Install Pierce Chuck (Nov 03)
• session output Costas Magos (Nov 03)
  • Re: session output Matt Kettler (Nov 03)
    • Re: session output Costas Magos (Nov 04)
      • Re: session output Erek Adams (Nov 04)
      • Re: session output Costas Magos (Nov 05)
  • <Possible follow-ups>
  • Re: session output Costas Magos (Nov 04)
• RE: XML Plugins David Stubblefield (Nov 03)
• Setting Up Policy-Based.rules file Kaplan, Andrew H. (Nov 03)
  • Message not available
    • Re: Setting Up Policy-Based.rules file Matt Kettler (Nov 03)
  • <Possible follow-ups>
  • RE: Setting Up Policy-Based.rules file Kaplan, Andrew H. (Nov 03)
• Snort outside firewall Lane LiaBraaten (Nov 03)
  • Re: Snort outside firewall Michael Sierchio (Nov 03)
  • <Possible follow-ups>
  • Re: Snort outside firewall Mark . Schutzmann (Nov 03)
  • RE: Snort outside firewall Snort (Nov 03)
• Snort on Zaurus ... jon baer (Nov 03)
• Update to previous e-mail Kaplan, Andrew H. (Nov 03)
  • Message not available
    • Re: Update to previous e-mail Matt Kettler (Nov 03)
  • <Possible follow-ups>
  • RE: Update to previous e-mail Kaplan, Andrew H. (Nov 03)
• snort installation error edmund . li (Nov 03)
  • Re: snort installation error Ciprian Badescu (Nov 04)
  • <Possible follow-ups>
  • RE: snort installation error Snort (Nov 04)
• IDS Policy Manager 1.3.1 Build 46 Released Jeff Dell (Nov 04)
• welchia rule David Omar Ortega Aranda (Nov 04)
  • <Possible follow-ups>
  • RE: welchia rule Schmehl, Paul L (Nov 04)
  • RE: welchia rule Leonard Miller (Nov 04)
  • RE: welchia rule Schmehl, Paul L (Nov 04)
  • RE: welchia rule Leonard Miller (Nov 04)
  • RE: welchia rule John Impallomeni (Nov 04)
  • RE: welchia rule Schmehl, Paul L (Nov 04)
    • A tool like swatch Sir Fenix (Nov 06)
      • Re: [Snort-sigs] A tool like swatch Matt Kettler (Nov 05)
      • Re: Re: [Snort-sigs] A tool like swatch Edin Dizdarevic (Nov 05)
      • Re: [Snort-sigs] A tool like swatch Sir Fenix (Nov 06)
      • Re: A tool like swatch Jim Brown (Nov 08)
  • RE: welchia rule Schmehl, Paul L (Nov 04)
  • RE: welchia rule Mark . Schutzmann (Nov 05)
  • RE: welchia rule Schmehl, Paul L (Nov 05)
• RE: [Snort-sigs] capture email Snort (Nov 04)
  • <Possible follow-ups>
  • RE: [Snort-sigs] capture email Snort (Nov 04)
  • RE: RE: [Snort-sigs] capture email Schmehl, Paul L (Nov 04)
  • RE: RE: [Snort-sigs] capture email Ricardo Londono (Nov 05)
• Snort 2.0.3 Chris Green (Nov 04)
• Snort logging to encrypted MySQL (ssl) server? David DeCoster (Nov 04)
  • Re: Snort logging to encrypted MySQL (ssl) server? jon baer (Nov 04)
    • Re: Snort logging to encrypted MySQL (ssl) server? David DeCoster (Nov 04)
      • Re: Snort logging to encrypted MySQL (ssl) server? jon baer (Nov 04)
      • Re: Snort logging to encrypted MySQL (ssl) server? David DeCoster (Nov 04)
      • Re: Snort logging to encrypted MySQL (ssl) server? Frank Knobbe (Nov 04)
  • Re: Snort logging to encrypted MySQL (ssl) server? Ben Nelson (Nov 04)
  • Re: Snort logging to encrypted MySQL (ssl) server? omi (Nov 04)
  • Re: Snort logging to encrypted MySQL (ssl) server? Dirk Geschke (Nov 05)
  • <Possible follow-ups>
  • RE: Snort logging to encrypted MySQL (ssl) server? PPowenski (Nov 05)
  • Snort logging to encrypted MySQL (ssl) server? David DeCoster (Nov 05)
    • Re: Snort logging to encrypted MySQL (ssl) server? boka (Nov 06)
• RE: [Snort-sigs] rules update question Snort (Nov 04)
• Snort with IPSec Josh Berry (Nov 04)
  • Re: Snort with IPSec Chris Green (Nov 04)
    • Re: Snort with IPSec Josh Berry (Nov 04)
      • Re: Snort with IPSec Frank Knobbe (Nov 04)
      • Re: Snort with IPSec Josh Berry (Nov 05)
      • Re: Snort with IPSec Ravi Kumar (Nov 05)
  • Message not available
    • Re: Snort with IPSec Matt Kettler (Nov 04)
  • <Possible follow-ups>
  • RE: Snort with IPSec O'Flynn, Derek (Nov 04)
  • Re: Snort with IPSec Mark . Schutzmann (Nov 04)
    • Re: Snort with IPSec Josh Berry (Nov 04)
      • Re: Snort with IPSec Jason Haar (Nov 04)
• Snort, mysql and sockets _ 0kita (Nov 04)
• Snort logging to encrypted MySQL (ssl) server Jason Monroe "JC" (Nov 04)
• Compiling 2.0.3 (and 2.0.2) on Solaris 9 sparc Chris Garringer (Nov 04)
  • Re: Compiling 2.0.3 (and 2.0.2) on Solaris 9 sparc Erek Adams (Nov 04)
    • Re: Compiling 2.0.3 (and 2.0.2) on Solaris 9 sparc Daniél Haslinger (Nov 05)
  • <Possible follow-ups>
  • Re: Compiling 2.0.3 (and 2.0.2) on Solaris 9 sparc Harry M. Leitzell III (Nov 04)
• RE: welchia rule, nachie and CyberKit 2.2 Jason Truong (Nov 04)
• 2.0.3 strange problems Matt Kettler (Nov 04)
  • Re: Resolved- 2.0.3 strange problems Matt Kettler (Nov 06)
  • <Possible follow-ups>
  • Re: 2.0.3 strange problems Michael Scheidell (Nov 05)
    • Re: 2.0.3 strange problems boka (Nov 06)
  • Re: 2.0.3 strange problems Michael Scheidell (Nov 06)
• Where to start snort from ????? kanwal (Nov 04)
  • RE: Where to start snort from ????? Michael Steele (Nov 04)
• Upgrading to Snort 2.0.2 or 2.0.3 Egal A Egal - SA (Nov 04)
  • Re: Upgrading to Snort 2.0.2 or 2.0.3 Erek Adams (Nov 05)
• WINSNORT.com - Major Announcement - MSSQL Guides Michael Steele (Nov 05)
  • <Possible follow-ups>
  • WINSNORT.com - Major Announcement - MSSQL Guides Michael Steele (Nov 05)
• dropped packets Mark McDonagh (Nov 05)
• Fallacies and lies. Mark Penny (Nov 05)
  • Re: Fallacies and lies. Edin Dizdarevic (Nov 05)
  • <Possible follow-ups>
  • RE: Fallacies and lies. Bob Walder (Nov 05)
    • RE: Fallacies and lies. Rich Adamson (Nov 05)
  • RE: Fallacies and lies. Bob Walder (Nov 05)
    • Re: Fallacies and lies. Jason Haar (Nov 05)
  • RE: Fallacies and lies. Bob Walder (Nov 06)
  • Re: Fallacies and lies. Marc Quibell (Nov 06)
• snort 2.0.3 on redhat 7.0 - seg. fault boka (Nov 05)
  • Re: snort 2.0.3 on redhat 7.0 - seg. fault Erek Adams (Nov 05)
• Improving overall performance of snort and stopping those drops Scott Zawalski (Nov 05)
  • Re: Improving overall performance of snort and stopping those drops Edin Dizdarevic (Nov 05)
• Archive Leonard Miller (Nov 05)
  • Re: Archive Matt Kettler (Nov 05)
  • Re: Archive Erek Adams (Nov 05)
• Barnyard seems to do nothing Iain Hallam (Nov 05)
• looking into SNORT Scott Elgram (Nov 05)
  • Re: looking into SNORT Bryan Irvine (Nov 05)
    • P2P Rules Martin Bündgens (Nov 05)
  • <Possible follow-ups>
  • RE: looking into SNORT John Impallomeni (Nov 05)
    • RE: looking into SNORT Dingo (Nov 05)
  • Re: looking into SNORT Mark . Schutzmann (Nov 05)
  • RE: looking into SNORT Schmehl, Paul L (Nov 06)
• Teaching Snort/Packet Analysis/Etc jon baer (Nov 05)
• Welchia/Nachi rule Schmehl, Paul L (Nov 05)
  • <Possible follow-ups>
  • Re: Welchia/Nachi rule Gabriel L. Somlo (Nov 06)
• Snort Wireless Sp0oKeR Labs (Nov 05)
  • Re: Snort Wireless Michael Sierchio (Nov 05)
    • Re: Snort Wireless jon baer (Nov 05)
• Test if Snort Work Correctly TOPTREND - Samuel de Oliveira (Nov 05)
  • Message not available
    • Re: Test if Snort Work Correctly Matt Kettler (Nov 05)
  • Re: Test if Snort Work Correctly jon baer (Nov 05)
  • <Possible follow-ups>
  • Re: Test if Snort Work Correctly Mark . Schutzmann (Nov 05)
• Log all traffic? nick travis (Nov 05)
  • Re: Log all traffic? Mark Nipper (Nov 05)
    • Re: Log all traffic? Matt Kettler (Nov 05)
      • Re: Log all traffic? jon baer (Nov 05)
      • Re: Log all traffic? Sp0oKeR Labs (Nov 06)
  • Re: Log all traffic? Matt Kettler (Nov 05)
  • Who doesn't care about virus rules, and why? kenw (Nov 05)
  • <Possible follow-ups>
  • Re: Log all traffic? Mark . Schutzmann (Nov 05)
• output plugins... execute command? David R. (Nov 05)
  • Re: output plugins... execute command? Matt Kettler (Nov 05)
• Snort statistics in deamon mode BOUDON Franck TRANSPAC (Nov 05)
  • Re: Snort statistics in deamon mode Mark Nipper (Nov 05)
  • RE: Snort statistics in deamon mode Jeff Dell (Nov 06)
• SnortCenter can't control Snort Daniél Haslinger (Nov 05)
• Problems compiling 2.0.3 on windows. snort user (Nov 06)
• bittorrent generating alerts Daniel Guido (Nov 06)
• RE: Who doesn't care about virus rules, and why? Williams Jon (Nov 06)
  • Re: Who doesn't care about virus rules, and why? Iain Hallam (Nov 06)
    • Re: Who doesn't care about virus rules, and why? Snortty (Nov 06)
  • RE: Who doesn't care about virus rules, and why? Jason Haar (Nov 06)
  • <Possible follow-ups>
  • RE: Who doesn't care about virus rules, and why? Schmehl, Paul L (Nov 06)
    • Re: Who doesn't care about virus rules, and why? kenw (Nov 06)
  • RE: Who doesn't care about virus rules, and why? Williams Jon (Nov 06)
• Building snort 2.0.3 on FreeBSD 4,8 Perrymon, Josh L. (Nov 06)
  • <Possible follow-ups>
  • RE: Building snort 2.0.3 on FreeBSD 4,8 Schmehl, Paul L (Nov 06)
    • Re: Building snort 2.0.3 on FreeBSD 4,8 Cristiano Deana (Nov 06)
• General usage statistics Keith Irvin (Nov 06)
  • <Possible follow-ups>
  • Re: General usage statistics Harry M. Leitzell III (Nov 07)
• Log all nick travis (Nov 06)
• Fwd: Re: [Snort-sigs] A tool like swatch Sylvester (Nov 06)
• strange behaviour of snort 2.0.3 lpj0508 (Nov 06)
• Barnyard Acid MySQL problem Billy Wright (Nov 06)
  • Re: Barnyard Acid MySQL problem Robert Vance Jr (Nov 06)
  • <Possible follow-ups>
  • RE: Barnyard Acid MySQL problem SRH-Lists (Nov 06)
• RE: Barnyard Acid MySQL problem SOLVED Billy Wright (Nov 06)
• Rule SID 1325 Matt Linton (Nov 06)
  • Re: Rule SID 1325 Brian (Nov 06)
• logging to a remote MSSQL database Majwabu, Richard (Nov 06)
• Snort 2.0.4 Chris Green (Nov 06)
  • Re: Snort 2.0.4 Daniel Wittenberg (Nov 06)
• trouble creating the ann-dir Rich Stryker (Nov 06)
• Other patches I've not seen (was: Resolved- 2.0.3 strange problems) Kreimendahl, Chad J (Nov 06)
  • Re: Other patches I've not seen Chris Green (Nov 06)
• RE: Other patches I've not seen Kreimendahl, Chad J (Nov 06)
• More explanation needed in Snort User Manual for "resp:"? Jason Haar (Nov 06)
  • Re: More explanation needed in Snort User Manual for "resp:"? Chris Green (Nov 06)
    • Re: More explanation needed in Snort User Manual for "resp:"? Jason Haar (Nov 06)
  • Re: More explanation needed in Snort User Manual for "resp:"? Kristofer T. Karas (Nov 06)
    • Re: More explanation needed in Snort User Manual for "resp:"? Jason Haar (Nov 06)
    • Re: More explanation needed in Snort User Manual for "resp:"? Jeff Nathan (Nov 20)
  • Re: More explanation needed in Snort User Manual for "resp:"? Matt Kettler (Nov 06)
• Windows 2.0.4 compile problems snort user (Nov 06)
  • <Possible follow-ups>
  • Re: Windows 2.0.4 compile problems snort user (Nov 07)
• MySQL Issues. Michael Thompson (Nov 06)
  • Re: MySQL Issues. Craig Paterson (Nov 06)
  • <Possible follow-ups>
  • Re: MySQL Issues. Leonard Miller (Nov 07)
• conversation and portscan2 timeout parameters Rohan Amin (Nov 06)
• Re:A tool like swatch Holger . Woehle (Nov 07)
• snort and proxy nosnos (Nov 07)
  • Re: snort and proxy Michael Boman (Nov 07)
    • Re: snort and proxy Sp0oKeR Labs (Nov 07)
• snort email Nosnos (Nov 07)
• snort and email Nosnos (Nov 07)
• RE: RE: [Snort-users] Who doesn't care about virus rules, and why? Abe Use (Nov 07)
  • <Possible follow-ups>
  • RE: Re: [Snort-users] Who doesn't care about virus rules, and why? Nick Duda (Nov 07)
• PLEASE CC ME Stephan Weaver (Nov 07)
  • Re: PLEASE CC ME Sean Lazar (Nov 08)
    • Re: PLEASE CC ME Erek Adams (Nov 08)
  • <Possible follow-ups>
  • Re: PLEASE CC ME Leonard Miller (Nov 08)
• My Snort get stuck when I stop/start many times. Pedro G . Méndez (Nov 07)
• RE: portscan traffic & acid Baxter, Anthony (ABAXTER) (Nov 07)
• Question about Ring PCAP\Snort\Environment Variables Mark Ewert (Nov 07)
  • Re: Question about Ring PCAP\Snort\Environment Variables Phil Wood (Nov 07)
  • <Possible follow-ups>
  • Question about Ring PCAP\Snort\Environment Variables Mark Ewert (Nov 07)
• FlexResp Error snort (Nov 07)
  • Re: FlexResp Error jon baer (Nov 07)
  • <Possible follow-ups>
  • RE: FlexResp Error snort (Nov 07)
• Followup question about Ring PCAP\Snort\Environment Variables Mark Ewert (Nov 07)
• Ref Error 1067 Bill Kaminski (Nov 07)
  • RE: Ref Error 1067 Michael Steele (Nov 07)
• Turbo patch/PACKET_RX_RING with 2.4.x kernels Scott Zawalski (Nov 08)
  • Re: Turbo patch/PACKET_RX_RING with 2.4.x kernels Phil Wood (Nov 09)
• installing snort with Mysql that has come with redhat 9 santosh bethi (Nov 09)
  • Re: installing snort with Mysql that has come with redhat 9 Patrick Harper (Nov 09)
    • Re: installing snort with Mysql that has come withredhat 9 jon baer (Nov 09)
• Re: Message from the void Phil Wood (Nov 09)
• Snort trap_snmp plugin jose alencar (Nov 10)
• scan.log and directory entry Robert Kriz (Nov 10)
• Snort not running Nyman Erik-IT-Enheten (Nov 10)
  • Re: Snort not running Josh Berry (Nov 10)
    • RE: Snort not running Erik Nyman (Nov 10)
  • Re: Snort not running Patrick Harper (Nov 10)
    • RE: Snort not running Erik Nyman (Nov 10)
      • RE: Snort not running Patrick Harper (Nov 10)
  • <Possible follow-ups>
  • RE: Snort not running Kaplan, Andrew H. (Nov 10)
• Packet size in snort log nick travis (Nov 10)
  • Re: Packet size in snort log Matt Kettler (Nov 10)
• RE: installing snort with Mysql that has come with redhat 9 Grejda, Eric (Nov 10)
• Snort.conf variables Remus (Nov 10)
  • Re: Snort.conf variables Matt Kettler (Nov 10)
    • Re: Snort.conf variables Remus (Nov 11)
      • Re: Snort.conf variables Matt Kettler (Nov 11)
  • Re: Snort.conf variables Erek Adams (Nov 11)
• Snort + Postgresql on Windows Erwin Van de Velde (Nov 10)
• Snort 2.0.4 on Solaris 8 John Creegan (Nov 10)
• Setting Password for root while configuring mySQL santosh bethi (Nov 11)
  • <Possible follow-ups>
  • RE: Setting Password for root while configuring mySQL Schmehl, Paul L (Nov 11)
• Same SRC/DST 127.0.0.1 Derrenbacker, L. Jonathan (Nov 11)
• Alert_SMB Scott Elgram (Nov 11)
• Snort and Suse 8.2 wbnt (Nov 11)
  • Re: Snort and Suse 8.2 Josh Berry (Nov 11)
    • Re: Snort and Suse 8.2 Michael Schwartzkopff (Nov 11)
• slahes in SQL statement a problem? Mike Couch (Nov 11)
  • Re: slahes in SQL statement a problem? jon baer (Nov 11)
• Snort 2.0.4 and threshold Povel, Michael (Nov 11)
  • RE: Snort 2.0.4 and threshold Marc Norton (Nov 11)
• unknown keyword resp Hernandez, Marco (Nov 11)
  • Re: unknown keyword resp Jeff Pricher (Nov 11)
  • Message not available
    • Re: unknown keyword resp Matt Kettler (Nov 11)
  • <Possible follow-ups>
  • RE: unknown keyword resp Hernandez, Marco (Nov 11)
    • Message not available
      • RE: unknown keyword resp Matt Kettler (Nov 12)
  • unknown keyword resp Avinash K (Dec 28)
• LogSnorter and Cisco router dlewis (Nov 11)
• AW: Snort 2.0.4 and threshold Povel, Michael (Nov 12)
  • Re: AW: Snort 2.0.4 and threshold Chris Green (Nov 12)
    • Re: AW: Snort 2.0.4 and threshold Chris Green (Nov 13)
      • Standalone threshold Jason Linden (Nov 13)
• Newbie Question on using snort IS Technical Services (Nov 12)
  • RES: Newbie Question on using snort Sp0oKeR Labs (Nov 12)
    • Re: RES: Newbie Question on using snort Donna dm87 (Nov 12)
• p2p scans showing up as SCAN FIN and SCAN NMAP ?? John York (Nov 12)
• Syn-Flood Frank Barton (Nov 12)
  • Re: Syn-Flood Matt Kettler (Nov 12)
• RE: RE: [Snort-users] Who doesn't care about virus r ules, and why? Williams Jon (Nov 12)
• Too much BAD TRAFFIC, LOOP TRAFFIC log messages MARIANO GABRIEL PARADA (Nov 12)
  • Re: Too much BAD TRAFFIC, LOOP TRAFFIC log messages Matt Kettler (Nov 12)
• New Sguil 0.3.0 Install Doc for FreeBSD 4.9 REL Richard Bejtlich (Nov 12)
• basic question using idscenter Bruyere, Michel (Nov 12)
  • Re: basic question using idscenter Ueli Kistler (Nov 13)
• snortsnarf problems Perrymon, Josh L. (Nov 12)
  • Re: snortsnarf problems Matt Kettler (Nov 12)
• log messsage question Pete (Nov 13)
• question about TAG Slighter, Tim (Nov 13)
  • Re: question about TAG Mark Nipper (Nov 13)
  • Re: question about TAG Chris Green (Nov 13)
• RE: RE: [Snort-users] Who doesn't care about virus r ules, and why? Lohman, James (Nov 13)
• Xml output plugin for Win32 Carpenter, Scott (OCTO) (Nov 13)
  • Re: Xml output plugin for Win32 jon baer (Nov 13)
• Re: [Snort-sigs] good settings for portscan preprocessor? Matt Kettler (Nov 13)
• Compiling under Debian... Tobias Rice (Nov 13)
  • Re: Compiling under Debian... Alexander Schinner (Nov 13)
    • Re: Compiling under Debian... Tobias Rice (Nov 13)
  • Re: Compiling under Debian... Jon Hart (Nov 13)
• RE: Standalone threshold Schmehl, Paul L (Nov 13)
  • <Possible follow-ups>
  • RE: Standalone threshold adam.w.hogan (Nov 13)
• Libnet make fatal error Shekar Reddy (Nov 13)
  • Re: Libnet make fatal error Dirk Geschke (Nov 14)
  • Re: Libnet make fatal error Jeff Nathan (Nov 20)
• Snort/Logsnorter/PureSecure Cisco ACL's Dave Lewis (Nov 13)
  • <Possible follow-ups>
  • Re: Snort/Logsnorter/PureSecure Cisco ACL's Michael Scheidell (Nov 17)
    • Re: Snort/Logsnorter/PureSecure Cisco ACL's Dave Lewis (Nov 21)
• Thanks to Patrick Harper Aryan D (Nov 14)
• not write alert file Hideki Hirata (Nov 14)
  • Re: not write alert file Matt Kettler (Nov 14)
    • Re: not write alert file Hideki Hirata (Nov 17)
      • Re: not write alert file Josh Berry (Nov 17)
      • Re: not write alert file Hideki Hirata (Nov 18)
    • Re: not write alert file Hideki Hirata (Nov 17)
• does snort detect ! Rahul (Nov 14)
  • Re: does snort detect ! Matt Kettler (Nov 14)
• Nmap Gerson Sampaio (Nov 14)
  • Re: Nmap Matt Kettler (Nov 14)
    • Re: Nmap Mark Fagan (Nov 15)
      • Re: Nmap Matt Kettler (Nov 18)
      • Re: Nmap Mark Fagan (Nov 19)
      • Re: Nmap Matt Kettler (Nov 19)
  • <Possible follow-ups>
  • RE: Nmap Esler, Joel - Contractor (Nov 17)
  • RE: Nmap MH (Nov 17)
  • RE: Nmap bmcdowell (Nov 19)
    • Message not available
      • RE: Nmap Matt Kettler (Nov 19)
  • RE: Nmap Marc Quibell (Nov 20)
• alert not write.!! Hideki Hirata (Nov 14)
• libnet fatal make error Shekar reddy (Nov 14)
• Alert Traffic Relative to Total Mark . Schutzmann (Nov 14)
• Snort Machines Friesz, Ross (Nov 14)
  • Re: Snort Machines Stacy J. Brandenburg (Nov 14)
  • Re: Snort Machines Duke Ionescu (Nov 14)
  • <Possible follow-ups>
  • Re: Snort Machines Marc Quibell (Nov 17)
  • RE: Snort Machines Friesz, Ross (Nov 17)
• Re: 13. Snort Machines (Friesz, Ross) MARIANO GABRIEL PARADA (Nov 14)
• HELP! Is snort combining packets?? Sheahan, Paul (Nov 14)
• Flexible Response snort (Nov 14)
  • Re: Flexible Response kongi (Nov 14)
• Newbie Cant run rules and needs config help Please attechni (Nov 14)
• Attack on snort running in Public Zone KS (Nov 14)
  • RE: Attack on snort running in Public Zone KS (Nov 14)
    • Re: RE: Attack on snort running in Public Zone james (Nov 14)
      • Re: RE: Attack on snort running in Public Zone Scot Scot (Nov 14)
      • RE: RE: Attack on snort running in Public Zone Michael Steele (Nov 14)
      • RE: RE: Attack on snort running in Public Zone kanwal (Nov 14)
      • RE: RE: Attack on snort running in Public Zone james (Nov 16)
      • RE: RE: Attack on snort running in Public Zone james (Nov 16)
      • RE: RE: Attack on snort running in Public Zone james (Nov 17)
    • RE: RE: Attack on snort running in Public Zone Michael Steele (Nov 14)
  • Re: Attack on snort running in Public Zone MH (Nov 14)
  • Re: Attack on snort running in Public Zone crtech (Nov 18)
    • RE: Attack on snort running in Public Zone Lucretia Enterprises Administrator (Nov 18)
      • RE: Attack on snort running in Public Zone Michael Steele (Nov 18)
    • AG M.D. DeWar (Nov 18)
      • Re: AG GDHough (Nov 18)
    • Re: Attack on snort running in Public Zone Matt Kettler (Nov 18)
  • <Possible follow-ups>
  • RE: Attack on snort running in Public Zone Geoff Craig (Nov 14)
  • RE: Attack on snort running in Public Zone Aaron (Nov 17)
  • RE: Attack on snort running in Public Zone bmcdowell (Nov 18)
    • Message not available
      • RE: Attack on snort running in Public Zone Matt Kettler (Nov 18)
      • RE: Attack on snort running in Public Zone Lucretia Enterprises Administrator (Nov 18)
      • RE: Attack on snort running in Public Zone Matt Kettler (Nov 19)
      • RE: Attack on snort running in Public Zone Jason Haar (Nov 18)
      • Re: Attack on snort running in Public Zone Craig Paterson (Nov 18)
      • Attack on snort running in Public Zone crtech (Nov 20)
• stream4: logging characteristics Brian A Kee (Nov 14)
• packets sent to OWN IP Sharif Corinaldi (Nov 14)
  • Re: packets sent to OWN IP jon baer (Nov 14)
  • Re: packets sent to OWN IP Chris Green (Nov 17)
• [ACID-search-year] GDHough (Nov 15)
  • Re: [ACID-search-year] Paul Schmehl (Nov 15)
• os x single user Donna dm87 (Nov 15)
• WINSNORT.com - Announcements (UNIX/Win32)! Michael Steele (Nov 16)
• Snort not outputting statistics on exit Mark Ewert (Nov 16)
• Figured it out!: Snort not outputting statistics on exit Mark Ewert (Nov 16)
  • Re: Figured it out!: Snort not outputting statistics on exit Phil Wood (Nov 16)
• snort rules update Aryan D (Nov 16)
  • Re: snort rules update Dragos Ruiu (Nov 17)
  • <Possible follow-ups>
  • Re: snort rules update Aryan D (Nov 20)
• Strange Key Words wbradd (Nov 17)
  • Re: Strange Key Words Matt Kettler (Nov 18)
• snort drop rate cbit ian (Nov 17)
• Snort 2.0.4 on OpenBSD 3.4 is dropping packets dlbox (Nov 17)
  • <Possible follow-ups>
  • RE: Snort 2.0.4 on OpenBSD 3.4 is dropping packets JP Vossen (Nov 17)
  • RE: Snort 2.0.4 on OpenBSD 3.4 is dropping packets SRH-Lists (Nov 17)
• database not getting updated M.D. DeWar (Nov 17)
  • Re: database not getting updated Josh Berry (Nov 17)
• Multiple sensors - setup with SNORT and SNORTSNARF Rich Stryker (Nov 17)
• How much can SNORT handle?? SNORT (Nov 17)
  • <Possible follow-ups>
  • RE: How much can SNORT handle?? Bob Walder (Nov 17)
    • graphing snort with acid M.D. DeWar (Nov 17)
• Fiber Tap SNORT (Nov 17)
  • Re: Fiber Tap Matt Kettler (Nov 19)
• Time Based IDS Rules Josh Berry (Nov 17)
  • <Possible follow-ups>
  • RE: Time Based IDS Rules adam.w.hogan (Nov 18)
• ACID 0.9.6b24 inactive references link sebastien desse (Nov 18)
  • RE: ACID 0.9.6b24 inactive references link Michael Steele (Nov 18)
• SnortCenter : $EXTERNAL_NET value overwriten when updating configuration sebastien desse (Nov 18)
• Threshold/Suppression question Jason Linden (Nov 18)
• Wireless: Rules & Classification Christopher Lewis (Nov 18)
  • Re: Wireless: Rules & Classification jon baer (Nov 18)
• var HTTP_PORTS and new rules Erik Nyman (Nov 18)
• Suspected DoS: BAD TRAFFIC loopback traffic Bosse Klykken (Nov 18)
• Re: Snort-users digest, Vol 1 #3751 - 9 msgs MARIANO GABRIEL PARADA (Nov 18)
• New Email Address for cmg and other changes Chris Green (Nov 18)
• experimental ipv6 maxime feroul (Nov 18)
• Problem with Snort 2.0.4 and Snort Rules Mark Ewert (Nov 18)
  • Message not available
    • Re: Problem with Snort 2.0.4 and Snort Rules Matt Kettler (Nov 18)
  • <Possible follow-ups>
  • RE: Problem with Snort 2.0.4 and Snort Rules Mark Ewert (Nov 18)
  • Re: Problem with Snort 2.0.4 and Snort Rules Nigel Houghton (Nov 18)
    • Message not available
      • Re: Problem with Snort 2.0.4 and Snort Rules Matt Kettler (Nov 19)
• HP Printers - SNMP Public Access udp bdushok (Nov 18)
  • Message not available
    • Re: HP Printers - SNMP Public Access udp Jason (Nov 18)
  • <Possible follow-ups>
  • Re: HP Printers - SNMP Public Access udp Mark . Schutzmann (Nov 18)
• wireless router with 4 port switch Fred McFeeters (Nov 18)
  • Re: wireless router with 4 port switch Matt Kettler (Nov 19)
    • Re: wireless router with 4 port switch twig les (Nov 19)
• password:curl: (6) Couldn't resolve host '' John Paul (Nov 18)
• curl with ssl compilation problem Shekar reddy (Nov 19)
• Script for windows server Mario Guerendo (Nov 19)
• snortcenter install problem Shekar reddy (Nov 19)
• Snort on multiple interfaces STEPHEN W. COREY - 5535 (Nov 19)
  • Re: Snort on multiple interfaces Martin Olsson (Nov 19)
• curl with ssl problem Shekar Reddy (Nov 19)
• SNORT install problem Shekar Reddy (Nov 19)
• Snort.conf Syntax Question Kaplan, Andrew H. (Nov 19)
  • Re: Snort.conf Syntax Question Mark Nipper (Nov 19)
• Sec configuration file Sebastien Desse (Nov 19)
  • rules error with @!#$ snortcenter SWIT (Nov 19)
• Snort Optimization: Better to Pass a rule or Disable? Mark Ewert (Nov 19)
• help shut this line up: can't find httpd.h eric johnson (Nov 19)
  • Re: help shut this line up: can't find httpd.h Paul Schmehl (Nov 19)
• how to convert tcpdump file back to its binary form Sarah Bassram (Nov 19)
  • <Possible follow-ups>
  • RE: how to convert tcpdump file back to its binary form Richard Bejtlich (Nov 20)
• Porting of Snort on micro controller linux aravind babu (Nov 20)
• catching up on snort messages Jeff Nathan (Nov 20)
• SNORT/LIBPCAP Lambeth, Darwin (Nov 20)
  • Re: SNORT/LIBPCAP Edin Dizdarevic (Nov 20)
• SNORT and LIBPCAP Lambeth, Darwin (Nov 20)
  • <Possible follow-ups>
  • RE: SNORT and LIBPCAP Schmehl, Paul L (Nov 20)
• problem with snort installation Salvatore Pagano (Nov 20)
  • <Possible follow-ups>
  • Re: problem with snort installation Leonard Miller (Nov 20)
• installing snort - Red Hat 9 - basic questions Patrick Nicholls (Nov 20)
• compiling snort with --mssql option Majwabu, Richard (Nov 20)
  • <Possible follow-ups>
  • Re: compiling snort with --mssql option Leonard Miller (Nov 20)
  • Re: compiling snort with --mssql option adam_peterson (Nov 20)
• Snort 2.0.4 CPU Utilization\Optimization Mark Ewert (Nov 20)
  • Re: Snort 2.0.4 CPU Utilization\Optimization Edin Dizdarevic (Nov 21)
    • Re: Snort 2.0.4 CPU Utilization\Optimization Edin Dizdarevic (Nov 21)
    • Re: Snort 2.0.4 CPU Utilization\Optimization Matt Kettler (Nov 21)
      • Re: Snort 2.0.4 CPU Utilization\Optimization Edin Dizdarevic (Nov 21)
  • RE: Snort 2.0.4 CPU Utilization\Optimization Tim (Nov 21)
  • <Possible follow-ups>
  • RE: Snort 2.0.4 CPU Utilization\Optimization Mark Ewert (Nov 20)
  • RE: Snort 2.0.4 CPU Utilization\Optimization Kreimendahl, Chad J (Nov 20)
  • RE: Snort 2.0.4 CPU Utilization\Optimization Mark Ewert (Nov 21)
  • RE: Snort 2.0.4 CPU Utilization\Optimization Mark Ewert (Nov 21)
  • RE: Snort 2.0.4 CPU Utilization\Optimization Kreimendahl, Chad J (Nov 21)
  • Re: Snort 2.0.4 CPU Utilization\Optimization Jason Haar (Nov 21)
• Snort 2.0.5 has been released! Jeremy Hewlett (Nov 20)
• ACID Graphs Martin Jr., D. Michael (Nov 20)
  • RE: ACID Graphs Mario Guerendo (Nov 20)
    • Re: ACID Graphs cc (Nov 21)
  • <Possible follow-ups>
  • RE: ACID Graphs Schmehl, Paul L (Nov 21)
• question about ICMP echo reply (undefinted code) rule Rob Burris (Nov 20)
  • Re: question about ICMP echo reply (undefinted code) rule Matt Kettler (Nov 20)
    • Re: question about ICMP echo reply (undefinted code) rule Rob Burris (Nov 20)
• snort and suse 7.3 cat thrasher (Nov 20)
  • Re: snort and suse 7.3 Scott Zawalski (Nov 20)
  • <Possible follow-ups>
  • RE: snort and suse 7.3 Lambeth, Darwin (Nov 20)
• How to read tdump.dat text file in snort? Sarah Bassram (Nov 20)
• Linux Ring buffer packet capture vs. normal capture Scott Zawalski (Nov 20)
• .i eth1 Timm Schneider (Nov 21)
  • Re: .i eth1 Matt Kettler (Nov 21)
• Monitoring traffic on 2 Interfaces Cabrera, Nestor (Contractor) (Nov 21)
  • RE: Monitoring traffic on 2 Interfaces Michael Steele (Nov 21)
• Snort logging problem Damiano Bolzoni (Nov 21)
  • <Possible follow-ups>
  • RE: Snort logging problem Bright, Mark IT2 (Nov 21)
• Design Document of Snort aravind babu (Nov 21)
  • Re: Design Document of Snort Ravi Kumar (Nov 23)
• How to log on MySql Damiano Bolzoni (Nov 21)
  • Re: How to log on MySql jon baer (Nov 21)
  • <Possible follow-ups>
  • RE: How to log on MySql Snort (Nov 21)
    • RE: How to log on MySql Michael Steele (Nov 22)
  • RE: How to log on MySql Michael Steele (Nov 22)
• How to stop snort? Damiano Bolzoni (Nov 21)
• Increase performance with filter or pass-rules Martin Olsson (Nov 21)
  • Re: Increase performance with filter or pass-rules Edin Dizdarevic (Nov 21)
  • <Possible follow-ups>
  • RE: Increase performance with filter or pass-rules SRH-Lists (Nov 21)
• Snort Alerting issue ... Mark Fagan (Nov 21)
• Thresholding Erwin Van de Velde (Nov 22)
• Snort Alerting .. Mark Fagan (Nov 22)
• acid, postgres and freebsd Jeremy Hefner (Nov 22)
• Why are splay trees used in the preprocessors? Joe Smith (Nov 22)
  • <Possible follow-ups>
  • Why are splay trees used in the preprocessors? Joe Smith (Nov 22)
    • Re: Why are splay trees used in the preprocessors? Dragos Ruiu (Nov 23)
      • RE: Why are splay trees used in the preprocessors? Jim Cervantes (Nov 23)
• got a little problem with acid and snort logging qodqod (Nov 22)
  • RE: got a little problem with acid and snort logging Michael Steele (Nov 22)
• Upgrading Snort 2.0.2 to 2.0.5 Derek (X-Networks) (Nov 23)
• compile error "parse error before `sa_family_t" mike (Nov 23)
• Logging portscan on database Damiano Bolzoni (Nov 24)
  • Re: Logging portscan on database Leonardo Spalenza (Nov 24)
    • Re: Logging portscan on database Erwin Van de Velde (Nov 24)
      • Re: Logging portscan on database Josh Berry (Nov 24)
• Visual layout of the db scheme (http://www.snort.org/docs/snortdb.png) Martin Olsson (Nov 24)
  • RE: Visual layout of the db scheme (http://www.snort.org/docs/snortdb.png) Jeff Dell (Nov 24)
• Snort ICMP # 485 Timm Schneider (Nov 24)
  • Re: Snort ICMP # 485 Glenn Forbes Fleming Larratt (Nov 24)
    • Re: Snort ICMP # 485 Timm Schneider (Nov 24)
• Testing problem, slow Bryan Taylor (Nov 24)
• Size of RAM required to run Snort aravind babu (Nov 24)
  • Re: Size of RAM required to run Snort Stein Boerge Sylvarnes (Nov 24)
  • Re: Size of RAM required to run Snort Matt Kettler (Nov 24)
• Testing problem bcptaylor (Nov 24)
• ANNOUNCEMENT: Snort-IDMEF-Plugin 1.2.1alpha released Sandro Poppi (Nov 24)
• Configuration of Flexresp2 Aryan D (Nov 24)
  • Re: Configuration of Flexresp2 Nerijus Krukauskas (Nov 24)
  • <Possible follow-ups>
  • Re: Configuration of Flexresp2 Aryan D (Nov 25)
    • Re: Configuration of Flexresp2 Jeff Nathan (Nov 25)
• Alert log file gandalf (Nov 24)
• small ? tomb (Nov 24)
  • <Possible follow-ups>
  • RE: small ? Jacob Roberts (Nov 24)
    • RE: small ? tomb (Nov 27)
  • small ? tomb (Nov 24)
  • RE: small ? SRH-Lists (Nov 24)
• Demarc + Snort 2.0.4/5 Snort (Nov 24)
  • Re: Demarc + Snort 2.0.4/5 Kristofer T. Karas (Nov 24)
    • Re: Demarc + Snort 2.0.4/5 Adriel T. Desautels (Nov 24)
  • <Possible follow-ups>
  • RE: Demarc + Snort 2.0.4/5 Snort (Nov 24)
• IP country lookup tim0707 (Nov 24)
  • RE: IP country lookup Jeff Dell (Nov 25)
    • Re: IP country lookup Tim (Nov 25)
  • <Possible follow-ups>
  • RE: IP country lookup Potts, Ross A. (Nov 25)
    • Message not available
      • RE: IP country lookup Matt Kettler (Nov 25)
• Trafic Filtering dlucio (Nov 24)
  • Re: Trafic Filtering Matt Kettler (Nov 24)
• Greetings list, this is my first post. Adriel T. Desautels (Nov 24)
• Can Snort report on 'late collisions'? Bryce Stenberg (Nov 24)
  • Re: Can Snort report on 'late collisions'? Matt Kettler (Nov 24)
  • <Possible follow-ups>
  • Re: Can Snort report on 'late collisions'? Bryce Stenberg (Nov 25)
• Snort 2.0.5 TCP Stream Fix Increases Performance Mark Ewert (Nov 24)
• Problem installing Barnyard with mySQL support Naman Latif (Nov 24)
  • Re: Problem installing Barnyard with mySQL support Adriel T. Desautels (Nov 24)
    • Re: Problem installing Barnyard with mySQL support Christopher Lewis (Nov 25)
• bad frag bits Samuel C. Adams (Nov 25)
  • Re: bad frag bits Brian (Nov 25)
    • snort inline && current rules. /dev/null (Nov 25)
      • Re: snort inline && current rules. Matt Kettler (Nov 25)
      • Re: snort inline && current rules. /dev/null (Nov 25)
      • Re: snort inline && current rules. Jeff Nathan (Nov 25)
      • Re: snort inline && current rules. Matt Kettler (Nov 25)
      • Re: snort inline && current rules. /dev/null (Nov 25)
      • Re: snort inline && current rules. Josh Berry (Nov 25)
      • snort inline behavior /dev/null (Nov 25)
      • Re: snort inline behavior /dev/null (Nov 26)
      • Re: snort inline behavior Stephan Scholz (Nov 26)
      • Re: snort inline behavior /dev/null (Nov 26)
      • Re: snort inline behavior Stephan Scholz (Nov 26)
      • Re: snort inline behavior Josh Berry (Nov 26)
  • Re: bad frag bits Matt Kettler (Nov 25)
• Can I still log every packet when thresholding the alerts? Williams Jon (Nov 25)
  • Re: Can I still log every packet when thresholding the alerts? Jason Haar (Nov 25)
• ACID / ALERT console browsing issue Shekar Reddy (Nov 25)
  • <Possible follow-ups>
  • Re: ACID / ALERT console browsing issue adam_peterson (Nov 25)
    • Re: Re: ACID / ALERT console browsing issue Josh Berry (Dec 03)
  • RE: Re: ACID / ALERT console browsing issue Schmehl, Paul L (Dec 03)
• snort idmef plugin yuedong wu (Nov 25)
  • Re: snort idmef plugin Matt Kettler (Nov 25)
    • Re: snort idmef plugin yuedong wu (Nov 26)
      • Re: snort idmef plugin Matt Kettler (Nov 28)
      • Re: snort idmef plugin yuedong wu (Dec 01)
      • Re: snort idmef plugin Craig Paterson (Dec 01)
      • Re: snort idmef plugin yuedong wu (Dec 03)
• does snort support token ring card Luo, Philip (Nov 25)
  • Re: does snort support token ring card Matt Kettler (Nov 25)
    • Re: does snort support token ring card Martin Olsson (Nov 28)
      • Re: does snort support token ring card Matt Kettler (Nov 28)
• Multiple Win32 occurances? Rich Adamson (Nov 25)
  • Re: Multiple Win32 occurances? Paul Schmehl (Nov 25)
    • RE: Multiple Win32 occurances? Michael Steele (Nov 25)
      • RE: Multiple Win32 occurances? Paul Schmehl (Nov 25)
      • RE: Multiple Win32 occurances? Michael Steele (Nov 25)
      • RE: Multiple Win32 occurances? Paul Schmehl (Nov 25)
    • Re: Multiple Win32 occurances? Rich Adamson (Nov 25)
      • Re: Multiple Win32 occurances? Paul Schmehl (Nov 25)
      • RE: Multiple Win32 occurances? Michael Steele (Nov 26)
  • <Possible follow-ups>
  • RE: Multiple Win32 occurances? Michael Steele (Nov 25)
  • RE: Multiple Win32 occurances? Jacob Roberts (Nov 26)
    • RE: Multiple Win32 occurances? Michael Steele (Nov 26)
  • RE: Multiple Win32 occurances? Schmehl, Paul L (Nov 26)
    • RE: Multiple Win32 occurances? Michael Steele (Nov 26)
• External Subnets adam_peterson (Nov 25)
  • Message not available
    • Re: External Subnets Matt Kettler (Nov 25)
  • Re: External Subnets Erwin Van de Velde (Nov 25)
  • <Possible follow-ups>
  • Re: External Subnets adam_peterson (Nov 25)
• AW: snort idmef plugin Poppi, Sandro (Nov 25)
• *very* many snort installations.. Mokum (Nov 26)
  • Re: *very* many snort installations.. Shane Smith (Nov 26)
  • RE: *very* many snort installations.. Michael Steele (Nov 26)
    • RE: *very* many snort installations.. Jason Haar (Nov 26)
  • <Possible follow-ups>
  • RE: *very* many snort installations.. hugh_fraser (Nov 28)
    • Re: *very* many snort installations.. Adriel T. Desautels (Dec 02)
• flexresp - I have 2 stupid questions Rich Stryker (Nov 26)
  • Re: flexresp - I have 2 stupid questions Matt Kettler (Nov 26)
  • <Possible follow-ups>
  • RE: flexresp - I have 2 stupid questions Rich Stryker (Nov 26)
    • RE: flexresp - I have 2 stupid questions Matt Kettler (Nov 26)
    • RE: flexresp - I have 2 stupid questions Michael Steele (Nov 26)
    • Re: flexresp - I have 2 stupid questions Jeff Nathan (Nov 26)
• MySQL Disconnects adam_peterson (Nov 26)
  • Re: MySQL Disconnects Ben Nelson (Nov 26)
• Re: MySQL Disconnects/Mudpit adam_peterson (Nov 26)
  • RE: MySQL Disconnects/Mudpit Michael Steele (Nov 26)
• Passive Ethernet Tap. Peters, Michael D. (Nov 26)
• Installing SnortCenter on a Windows 2000 machine Atkins, Dwane P (Nov 26)
  • RE: Installing SnortCenter on a Windows 2000 machine Michael Steele (Nov 26)
• Re: [Snort-Users] Is it really a HUB? Finney Charles E (Nov 26)
  • Re: [Snort-Users] Is it really a HUB? kenw (Nov 28)
    • OT but security related - world wide VPN /dev/null (Nov 28)
• rules and the EXTERNAL_NET variable adam_peterson (Nov 26)
  • <Possible follow-ups>
  • RE: rules and the EXTERNAL_NET variable Schmehl, Paul L (Nov 26)
• See only code for php.test eric johnson (Nov 26)
• Any good tool for generating nice reports off a years worth of snort syslog data? Jason Haar (Nov 26)
  • Re: Any good tool for generating nice reports off a years worth of snort syslog data? Chris Keladis (Dec 03)
• net.ipv4.ipfrag_time for Windows (and other OSs as well) Edin Dizdarevic (Nov 27)
• Question about negated and non-negated variables in rules J-H. Johansen (Nov 27)
  • Re: Question about negated and non-negated variables in rules J-H. Johansen (Nov 27)
    • Re: [OT] Question about negated and non-negated variables in rules Matt Kettler (Nov 28)
  • Re: Question about negated and non-negated variables in rules Matt Kettler (Nov 28)
    • Re: Question about negated and non-negated variables in rules Jens-Harald Johansen (Nov 28)
      • Re: Question about negated and non-negated variables in rules Matt Kettler (Nov 28)
      • Re: Question about negated and non-negated variables in rules Jens-Harald Johansen (Nov 29)
      • Re: Question about negated and non-negated variables in rules Matt Kettler (Dec 01)
      • Re: Question about negated and non-negated variables in rules J-H. Johansen (Dec 01)
      • Re: Question about negated and non-negated variables in rules Matt Kettler (Dec 01)
• snort & pppoe Jo (Nov 27)
  • AW: snort & pppoe Jo (Dec 05)
  • <Possible follow-ups>
  • snort & pppoe Jo (Dec 03)
• Snort not backdoored, Sourcefire not compromised Martin Roesch (Nov 27)
• Re: Question about negated and non-negated variable s in rules corinth (Nov 28)
• Announce: FLoP-1.0 --- Fast Logging Project for snort Dirk Geschke (Nov 28)
  • Message not available
    • Re: Announce: FLoP-1.0 --- Fast Logging Project for snort Dirk Geschke (Nov 28)
      • MYSQL Error on Windows XP snort install Tim (Nov 28)
  • Message not available
    • Message not available
      • Message not available
      • Message not available
      • Message not available
      • Message not available
      • Message not available
      • Message not available
      • Re: Announce: FLoP-1.0 --- Fast Logging Project for snort Dirk Geschke (Dec 02)
      • Re: Announce: FLoP-1.0 --- Fast Logging Project for snort Bamm Visscher (Dec 02)
• new snort user Fred McFeeters (Nov 28)
  • Re: new snort user james (Nov 29)
  • <Possible follow-ups>
  • New Snort User Benny Late (Dec 31)
• ICMP REDIRECT HOST Paulius (Nov 29)
  • Re: ICMP REDIRECT HOST Dirk Geschke (Nov 29)
    • Re: ICMP REDIRECT HOST Paulius (Nov 29)
    • Re: ICMP REDIRECT HOST Paulius (Nov 29)
• help Petrit Podrimja (Nov 29)
  • RE: help Michael Steele (Nov 29)
  • <Possible follow-ups>
  • Help Libalele, Silulami S (Dec 08)
    • Re: Help Patrick S. Harper - CISSP (Dec 09)
      • Re: Help Milo Velimirovic (Dec 09)
    • Re: Help Patrick S. Harper - CISSP (Dec 09)
  • RE: Help Libalele, Silulami S (Dec 09)
    • Re: Help David Alonso De La Vega Tapage (Dec 10)
  • Help henrique (Dec 31)
• snort-mysql, logging on TWO sql servers Michel Christophe (Nov 29)
  • Re: snort-mysql, logging on TWO sql servers Dirk Geschke (Nov 29)
  • RE: snort-mysql, logging on TWO sql servers Michael Steele (Nov 29)
  • <Possible follow-ups>
  • RE: snort-mysql, logging on TWO sql servers Michael Steele (Nov 29)
• Thanks For All The Help (snort new user) Fred McFeeters (Nov 29)
• Rule to capture only packets with certain content/bytes Admin (Nov 30)
  • Re: Rule to capture only packets with certain content/bytes Brian (Nov 30)
• snort 2.0.5 --with-mysql on a debian-system christian graf (Nov 30)
• Again Gerson Sampaio (Dec 01)
• [Fwd: Re: snort-mysql, logging on TWO sql servers] Michel Christophe (Dec 01)
• Passive Tap Help Peters, Michael D. (Dec 01)
  • Re: Passive Tap Help Frank Knobbe (Dec 01)
  • <Possible follow-ups>
  • RE: Passive Tap Help Peters, Michael D. (Dec 01)
    • RE: Passive Tap Help Lists (Dec 01)
    • RE: Passive Tap Help Frank Knobbe (Dec 01)
      • RE: Passive Tap Help Frank Knobbe (Dec 01)
      • RE: Passive Tap Help Lists (Dec 01)
      • RE: Passive Tap Help Frank Knobbe (Dec 01)
      • RE: Passive Tap Help Frank Knobbe (Dec 01)
      • RE: Passive Tap Help Dirk Geschke (Dec 01)
      • RE: Passive Tap Help Frank Knobbe (Dec 01)
      • RE: Passive Tap Help Frank Knobbe (Dec 03)
    • Re: Passive Tap Help kenw (Dec 01)
      • Re: Passive Tap Help Jeff Nathan (Dec 01)
      • Re: Passive Tap Help Frank Knobbe (Dec 01)
      • Re: Passive Tap Help Jeff Nathan (Dec 02)
• Sig for Windows messenger service direct access? Gary Flynn (Dec 01)
• SnortCenter and SnortSam unknown index (Dec 01)
• Slightly OT: high speed packet generation software doug (Dec 01)
  • Re: Slightly OT: high speed packet generation software Dirk Geschke (Dec 02)
  • Re: Slightly OT: high speed packet generation software Peter Schawacker (Dec 02)
• Re: [Snort-sigs] PCRE Rules and hexa Jeremy Hewlett (Dec 01)
• RE: Slightly OT: high speed packet generation softw are larosa, vjay (Dec 01)
• sguil.tk error sigtraq (Dec 01)
  • Re: sguil.tk error Bamm Visscher (Dec 02)
• Just one rule Marcin Krawiec (Dec 01)
• passive tap christian graf (Dec 02)
• Re: Announce: FLoP-1.0 --- Fast Logging Project for snort (fwd) Dirk Geschke (Dec 02)
• Problem with compiling snort dunervst (Dec 02)
  • <Possible follow-ups>
  • RE: Problem with compiling snort Grejda, Eric (Dec 02)
  • Problem with compiling snort dunervst (Dec 02)
  • Problem with compiling snort dunervst (Dec 03)
  • Re: Problem with compiling snort Dave Ellingsberg (Dec 05)
• [Fwd: RE: Problem with compiling snort] Cedric Foll (Dec 02)
  • Re: [Fwd: RE: Problem with compiling snort] Cedric Foll (Dec 02)
• conflict with alert types Jordi Vidal (Dec 02)
  • Re: conflict with alert types Martin Olsson (Dec 02)
    • Re: conflict with alert types Jordi Vidal (Dec 02)
• need help jeremy chartier (Dec 02)
• Reporting - Network Analyzers Mike Koponick (Dec 02)
  • Re: Reporting - Network Analyzers jon baer (Dec 02)
  • RE: Reporting - Network Analyzers James M. Driskell (Dec 02)
    • RE: Reporting - Network Analyzers twig les (Dec 02)
• Newbie Snort Questions Naman Latif (Dec 02)
• Oinkmaster v0.9 released. Andreas Östling (Dec 02)
• postgresql backend Nicholas Bernstein (Dec 02)
  • Re: postgresql backend Bryan Irvine (Dec 02)
  • Re: postgresql backend Frank Knobbe (Dec 02)
    • Re: postgresql backend Per-Erik Persson (Dec 04)
  • <Possible follow-ups>
  • Re: postgresql backend John Creegan (Dec 02)
• RE: MYSQL Error on Windows XP snort install Bright, Mark IT2 (Dec 02)
  • RE: MYSQL Error on Windows XP snort install Michael Steele (Dec 02)
    • Re: MYSQL Error on Windows XP snort install Tim (Dec 02)
      • RE: MYSQL Error on Windows XP snort install Michael Steele (Dec 03)
      • RE: MYSQL Error on Windows XP snort install Michael Steele (Dec 03)
  • <Possible follow-ups>
  • RE: MYSQL Error on Windows XP snort install Bright, Mark IT2 (Dec 02)
    • Re: MYSQL Error on Windows XP snort install Jim Brown (Dec 02)
      • RE: MYSQL Error on Windows XP snort install Michael Steele (Dec 03)
  • RE: MYSQL Error on Windows XP snort install Bright, Mark IT2 (Dec 02)
  • RE: MYSQL Error on Windows XP snort install Jacob Roberts (Dec 03)
  • RE: MYSQL Error on Windows XP snort install snortmail (Dec 03)
  • RE: MYSQL Error on Windows XP snort install Bright, Mark IT2 (Dec 03)
• acid, sig_priority Nicholas Bernstein (Dec 02)
  • Re: acid, sig_priority Chris Green (Dec 02)
• Re: Snort-users digest, Vol 1 #3790 - 8 msgs dunervst (Dec 03)
• XEXCH50 evasion rule parse problems? Erik Norman (Dec 03)
• Slightly OT: high speed packet generation Nordwall, Douglas J (Dec 03)
  • Re: Slightly OT: high speed packet generation Jim Brown (Dec 03)
• Problem with SWATCH for Snort logs. Pedro G . Méndez (Dec 03)
• Makefile, line 484: Unexpected ... Sebastian Juraszek (Dec 03)
  • <Possible follow-ups>
  • RE: Makefile, line 484: Unexpected ... Grime, Richard S (Dec 03)
• NMAP alerts bdushok (Dec 03)
  • <Possible follow-ups>
  • Re: NMAP alerts Maarten Van Horenbeeck (Dec 20)
• [snort-mysql] logging OK to logfile, not to mysql database Michel Christophe (Dec 03)
  • Re: [snort-mysql] logging OK to logfile, not to mysql database Josh Berry (Dec 03)
    • RE: [snort-mysql] logging OK to logfile, not to mysql database Michael Steele (Dec 03)
      • RE: [snort-mysql] logging OK to logfile, not to mysql database Michel Christophe (Dec 04)
• rule update causes seg fault Josh . Sakofsky (Dec 03)
  • <Possible follow-ups>
  • RE: rule update causes seg fault McGuire, Dennis (Dec 04)
• oinkmaster Nicholas Bernstein (Dec 03)
  • Re: oinkmaster Andreas Östling (Dec 03)
  • <Possible follow-ups>
  • re: oinkmaster adam_peterson (Dec 03)
• spp_rpc_decode Schmehl, Paul L (Dec 03)
  • Message not available
    • Re: spp_rpc_decode Josh Berry (Dec 03)
  • Re: spp_rpc_decode Jeremy Hewlett (Dec 05)
    • Re: spp_rpc_decode Paul Schmehl (Dec 05)
      • Re: spp_rpc_decode Chris Green (Dec 06)
• Question about hardware and software requirement for Snort 2.0.5 Ganbold (Dec 03)
  • Re: Question about hardware and software requirement for Snort 2.0.5 twig les (Dec 03)
• Corrupt Snort Logging - Win32 Terminal Server 2000 Jim Robinson (Dec 03)
  • RE: Corrupt Snort Logging - Win32 Terminal Server 2000 Michael Steele (Dec 03)
    • RE: Corrupt Snort Logging - Win32 Terminal Server 2000 Jim Robinson (Dec 04)
      • RE: Corrupt Snort Logging - Win32 Terminal Server 2000 John Tapparo (Dec 04)
      • RE: Corrupt Snort Logging - Win32 Terminal Server2000 Michael Steele (Dec 04)
• Snort and L2 Cache Irwan Hadi (Dec 04)
  • Re: Snort and L2 Cache Dirk Geschke (Dec 04)
    • Re: Snort and L2 Cache Matt Kettler (Dec 04)
  • <Possible follow-ups>
  • Re: Snort and L2 Cache Brian . Cook (Dec 04)
• same source and destination Petrit Podrimja (Dec 04)
• RE: slashes in SQL statement a problem? wfz (Dec 04)
• Snort on OpenBSD -- finding mysqlclient library dlbox (Dec 04)
  • RE: Snort on OpenBSD -- finding mysqlclient library robert schwartz (Dec 04)
  • Re: Snort on OpenBSD -- finding mysqlclient library Jeff Nathan (Dec 04)
  • <Possible follow-ups>
  • RE: Snort on OpenBSD -- finding mysqlclient library dlbox (Dec 04)
• Snort not working with mysql on a redhat machine Thomas Los (Dec 04)
• Snort Alert Help for Rule : SID=2 Naman Latif (Dec 04)
  • RE: Snort Alert Help for Rule : SID=2 Jeff Dell (Dec 04)
  • <Possible follow-ups>
  • RE: Snort Alert Help for Rule : SID=2 Naman Latif (Dec 04)
• mysql.sock not found Shashank Bhide (Dec 04)
  • Re: mysql.sock not found Dirk Geschke (Dec 04)
• FW:[Snort-users] RE: slashes in SQL statement a problem? wfz (Dec 04)
  • RE: FW:[Snort-users] RE: slashes in SQL statement a problem? Michael Steele (Dec 04)
• RE:RE: [Snort-users] FW:[Snort-users] RE: slashes in SQL statement a problem? wfz (Dec 04)
  • RE: RE:RE: [Snort-users] FW:[Snort-users] RE: slashes in SQL statement a problem? Michael Steele (Dec 04)
• Log Rotation Keaton, Lindamaria (Dec 04)
  • <Possible follow-ups>
  • Re: Log Rotation JP Vossen (Dec 04)
  • Re: Log Rotation Stephane Nasdrovisky (Dec 05)
  • RE: Log Rotation Keaton, Lindamaria (Dec 05)
    • RE: Log Rotation JP Vossen (Dec 05)
• arpspoof plug-in adam_peterson (Dec 04)
• Re: Log Rotation (fwd) JP Vossen (Dec 05)
  • RE: Re: Log Rotation (fwd) Michael Steele (Dec 05)
• flags SYN question... gfyspf () yahoo com (Dec 05)
  • Re: flags SYN question... Brian (Dec 05)
  • Re: flags SYN question... Matt Kettler (Dec 05)
• Fast log but with payload size Damiano Bolzoni (Dec 05)
• Remote Sensor?? kerberos K (Dec 05)
  • Re: Remote Sensor?? Valter Santos (Dec 16)
• RE:[Snort-users] Remote Sensor?? wfz (Dec 05)
  • <Possible follow-ups>
  • RE: RE:[Snort-users] Remote Sensor?? kerberos K (Dec 05)
• SHELLCODE Attacks Naman Latif (Dec 05)
  • Re: SHELLCODE Attacks Matt Kettler (Dec 05)
    • Re: SHELLCODE Attacks Erwin Van de Velde (Dec 05)
      • Re: SHELLCODE Attacks Matt Kettler (Dec 05)
      • Re: SHELLCODE Attacks Jeff Nathan (Dec 05)
      • Re: SHELLCODE Attacks Matt Kettler (Dec 05)
  • <Possible follow-ups>
  • RE: SHELLCODE Attacks Naman Latif (Dec 05)
    • Windows 2000 Terminal Snort Issues Jim Robinson (Dec 05)
• [Off topic] Traffic analysis Erwin Van de Velde (Dec 05)
  • <Possible follow-ups>
  • RE: [Off topic] Traffic analysis Richard Bejtlich (Dec 05)
  • RE: [Off topic] Traffic analysis Richard Bejtlich (Dec 05)
• Pre-Processor Alerts based on Traffic Flow Direction Naman Latif (Dec 05)
• Paul CTR Passey/AEA/CNTR/FAA is out of the office. Paul . CTR . Passey (Dec 07)
• Re: [Snort-devel] number of packets processed is mis-calculated under Linux Phil Wood (Dec 08)
• -l parameter adam_peterson (Dec 08)
  • Re: -l parameter Dirk Geschke (Dec 08)
    • Re: -l parameter Chris Keladis (Dec 08)
  • RE: -l parameter Ed Callahan (Dec 09)
  • <Possible follow-ups>
  • Re: -l parameter adam_peterson (Dec 08)
    • RE: -l parameter Michael Steele (Dec 08)
  • Re: -l parameter adam_peterson (Dec 09)
  • Re: -l parameter John Creegan (Dec 09)
  • Re: -l parameter adam_peterson (Dec 09)
    • Re: -l parameter twig les (Dec 09)
    • RE: -l parameter Ed Callahan (Dec 09)
      • Re: -l parameter Dirk Geschke (Dec 10)
      • RE: -l parameter Antonio Costa (Dec 10)
• Re: [Snort-sigs] To drop packets JP Vossen (Dec 08)
• Looking for recommendations for distributed Snort GiGE Sensors (network architecture described in message) Landon Stewart (Dec 08)
  • RE: Looking for recommendations for distributed Snort GiGE Sensors (network architecture described in message) Tim (Dec 09)
  • <Possible follow-ups>
  • RE: Looking for recommendations for distributed Snort GiGE Sensors (network architecture described in message) Val P (Dec 10)
    • RE: Looking for recommendations for distributed Snort GiGE Sensors (network architecture described in message) Michael Steele (Dec 10)
      • RE: Looking for recommendations for distributed Snort GiGE Sensors (network architecture described in message) Landon Stewart (Dec 11)
    • RE: Looking for recommendations for distributed Snort GiGE Sensors (network architecture described in message) Jason Haar (Dec 11)
    • RE: Looking for recommendations for distributed Snort GiGE Sensors (network architecture described in message) Landon Stewart (Dec 11)
• Snort-reports update Pieter Claassen (Dec 09)
• html post question Rich Adamson (Dec 09)
  • Re: html post question Matt Kettler (Dec 09)
• Improving ACID DB Performance via Plug-In Keith W. McCammon (Dec 09)
• MSSQL, linux, odbc Ryan Potts (Dec 09)
• To discuss: FLoP and missing database Dirk Geschke (Dec 09)
• snort-users () lists sourceforge net sama (Dec 09)
  • Re: snort-users () lists sourceforge net Matt Kettler (Dec 09)
    • Re: snort-users () lists sourceforge net twig les (Dec 09)
• Re: [Snort-devel] To discuss: FLoP and missing database (fwd) Dirk Geschke (Dec 10)
• Snort 1.8.7 does not log anything (OS: SuSE 8.1) Ralf Mellis (Dec 10)
  • RE: Snort 1.8.7 does not log anything (OS: SuSE 8.1) Michael Steele (Dec 10)
    • Re: Snort 1.8.7 does not log anything (OS: SuSE 8.1) Ralf Mellis (Dec 11)
    • Re: Snort 1.8.7 does not log anything (OS: SuSE 8.1) Ralf Mellis (Dec 11)
      • RE: Snort 1.8.7 does not log anything (OS: SuSE 8.1) Michael Steele (Dec 11)
  • <Possible follow-ups>
  • Re: Snort 1.8.7 does not log anything (OS: SuSE 8.1) JP Vossen (Dec 11)
    • Re: Snort 1.8.7 does not log anything (OS: SuSE 8.1) Ralf Mellis (Dec 13)
• Prelude Hybrid IDS Mahdi Kefayati (Dec 10)
  • Re: Prelude Hybrid IDS Matt (Dec 10)
• IMAGES? Libalele, Silulami S (Dec 10)
  • Message not available
    • Re: IMAGES? Matt Kettler (Dec 10)
  • <Possible follow-ups>
  • RE: IMAGES? Libalele, Silulami S (Dec 11)
    • RE: IMAGES? Michael Steele (Dec 11)
• starting snort-Mysql on Mandrake 9.2 Michel Christophe (Dec 10)
  • Re: starting snort-Mysql on Mandrake 9.2 Dirk Geschke (Dec 10)
• Snort IDS Lambeth, Darwin (Dec 10)
  • Re: Snort IDS Matt Kettler (Dec 10)
  • <Possible follow-ups>
  • RE: Snort IDS Lambeth, Darwin (Dec 10)
• Snort Sensor Hardware Jason Alexander (Dec 10)
  • RE: Snort Sensor Hardware robert schwartz (Dec 10)
  • Re: Snort Sensor Hardware Matt Kettler (Dec 10)
  • Re: Snort Sensor Hardware Jason (Dec 11)
  • <Possible follow-ups>
  • RE: Snort Sensor Hardware CGhercoias (Dec 10)
    • RE: Snort Sensor Hardware Michael Steele (Dec 10)
      • Re: Snort Sensor Hardware Brian (Dec 10)
      • Re: Snort Sensor Hardware Matt Kettler (Dec 10)
  • RE: Snort Sensor Hardware SRH-Lists (Dec 10)
    • RE: Snort Sensor Hardware Matt Kettler (Dec 10)
      • Re: Snort Sensor Hardware Jason Alexander (Dec 10)
  • RE: Snort Sensor Hardware CGhercoias (Dec 10)
• Remote NIDS Grammer, Christopher S (Dec 10)
  • Re: Remote NIDS Sp0oKeR Labs (Dec 10)
  • Re: Remote NIDS Dirk Geschke (Dec 11)
    • Re: Remote NIDS Paul Schmehl (Dec 11)
• Database output Erwin Van de Velde (Dec 10)
  • Re: Database output Dirk Geschke (Dec 11)
    • Re: Database output Erwin Van de Velde (Dec 11)
      • Re: Database output Dirk Geschke (Dec 11)
      • Re: Database output Erwin Van de Velde (Dec 11)
  • <Possible follow-ups>
  • RE: Database output Hutchinson, Andrew (Dec 11)
    • Re: Database output Erwin Van de Velde (Dec 11)
• Snort, Mysql purging Jack Snedecor (Dec 10)
  • Re: Snort, Mysql purging Josh Berry (Dec 10)
    • Re: Snort, Mysql purging Frank Knobbe (Dec 10)
  • Re: Snort, Mysql purging Mark Fagan (Dec 11)
• Visual Basic excel graph Mario Guerendo (Dec 10)
• src/snortman.tex Ted Rolle (Dec 10)
  • Re: src/snortman.tex Dirk Geschke (Dec 11)
• Re : src/snortman.tex Saravanan (Dec 10)
• Re: Snort-users digest, Vol 1 #3813 - 6 msgs Arif OZGUR (Dec 10)
• Snort deamon mode packet drop's statistic Thomas Reisinger (Dec 11)
  • Re: Snort deamon mode packet drop's statistic Dirk Geschke (Dec 11)
    • RE: Snort deamon mode packet drop's statistic Michael Steele (Dec 11)
  • <Possible follow-ups>
  • RE: Snort deamon mode packet drop's statistic Thomas Reisinger (Dec 11)
    • Re: Snort deamon mode packet drop's statistic Dirk Geschke (Dec 11)
  • RE: Snort deamon mode packet drop's statistic Thomas Reisinger (Dec 11)
    • Re: Snort deamon mode packet drop's statistic Dirk Geschke (Dec 11)
• os fingerprinting again Raber (Dec 11)
• Alerting concept... peter . grosse-hering (Dec 11)
• a couple of questions Giannakis Eleftherios (Dec 11)
  • Re: a couple of questions Matt Kettler (Dec 11)
    • Re: a couple of questions Giannakis Eleftherios (Dec 12)
    • Newbie question on gnutella rule Chris Hoover (Dec 13)
      • Re: Newbie question on gnutella rule Josh Berry (Dec 13)
      • Re: Newbie question on gnutella rule Michael Boman (Dec 13)
  • <Possible follow-ups>
  • RE: a couple of questions DeBerry, Casey (Dec 11)
• Possible false positive? Harry M (Dec 11)
  • Re: Possible false positive? Josh Berry (Dec 11)
    • RE: Possible false positive? Harry M (Dec 15)
• Rule causes a Segmentation Fault SN ORT (Dec 11)
• Office application cause false Nachi signature Elijah Savage (Dec 11)
  • Re: Office application cause false Nachi signature Brian (Dec 12)
• sniffing on two NIC simultaneously KS (Dec 11)
  • Re: sniffing on two NIC simultaneously Matt Kettler (Dec 11)
• FW: Snortsnarf: First_Last undefined David Newsom (Dec 11)
  • RE: FW: Snortsnarf: First_Last undefined Michael Steele (Dec 11)
  • <Possible follow-ups>
  • RE: FW: Snortsnarf: First_Last undefined Michael Steele (Dec 11)
• Syslog Alert format? JP Vossen (Dec 11)
  • Re: Syslog Alert format? Ralf Spenneberg (Dec 12)
• Runtime memory problem with snort-inline 2.0.2 aravind babu (Dec 11)
• Problem !! Pass command doesn't work 이지훈 (Dec 11)
• Top rules Ed Smith (Dec 12)
  • error M.D. DeWar (Dec 12)
    • Re: error Matt Kettler (Dec 12)
• HP Digital Sender Michael . Mulholland (Dec 12)
  • Re: HP Digital Sender Matt Kettler (Dec 12)
• RE: error Mike Koponick (Dec 12)
• 0.x.x.x source IP snort (Dec 12)
  • Re: 0.x.x.x source IP Rob Schrack (Dec 12)
• Some odd traffic. Matt Linton (Dec 12)
  • Re: Some odd traffic. twig les (Dec 12)
    • Upgrading Snortalog.pl v1.9 to v2.0.0??? Snortty (Dec 16)
      • Re: Upgrading Snortalog.pl v1.9 to v2.0.0??? jérémy chartier (Dec 16)
      • oinkmaster.conf enterred disablesid - get enbalbed Snortty (Dec 16)
      • Re: oinkmaster.conf enterred disablesid - get enbalbed Andreas Östling (Dec 16)
• Snort-Mysql and ssl Michel Christophe (Dec 12)
• Using ACID AND SnortSnarf - How? Ralf Henze (Dec 12)
  • Re: Using ACID AND SnortSnarf - How? Ralf Spenneberg (Dec 12)
• MySQL Connection Dropping adam_peterson (Dec 12)
• RE: Pushing MAC addreses from Snort into SQL .. Michael Chapman (Dec 12)
• snort just stop when more 32000 alerts (different IPs) aregenerated maguiler () cantv net (Dec 12)
  • Re: snort just stop when more 32000 alerts (different IPs) aregenerated twig les (Dec 12)
  • <Possible follow-ups>
  • snort just stop when more 32000 alerts (different IPs) aregenerated maguiler () cantv net (Dec 15)
    • RE: snort just stop when more 32000 alerts (different IPs) aregenerated Jerry Shenk (Dec 21)
      • Turning off signatures Jeff Kell (Dec 21)
      • Re: Turning off signatures twig les (Dec 21)
      • Re: snort just stop when more 32000 alerts (different IPs) aregenerated J-H. Johansen (Dec 22)
• Snort 2.1 Kerry Cox (Dec 12)
  • Re: Snort 2.1 Jeremy Hewlett (Dec 12)
• Snort and APF firewall Virgil Iancu (Dec 13)
  • Re: Snort and APF firewall Matt Kettler (Dec 13)
  • <Possible follow-ups>
  • Snort and APF firewall Virgil Iancu (Dec 13)
• plain text in content option triggering false alerts Dan (Dec 13)
• Help!!! Mario Guerendo (Dec 13)
  • Re: Help!!! Jim Brown (Dec 16)
• portscan2 log alerts Virgil Iancu (Dec 13)
• Getting Snort to work with http://www.mynetwatchman.com/ news (Dec 14)
• Rule to pass ARP? Toby Rodwell (Dec 14)
  • Re: Rule to pass ARP? Matt Kettler (Dec 14)
    • RE: Rule to pass ARP? Toby Rodwell (Dec 14)
• Problem in accessing ACID homepage Ramesh Patil (Dec 14)
• Logging of TCP and UDP packets? Libalele, Silulami S (Dec 15)
• Problem with settin up Snort on win XP Sjögren Claes (Dec 15)
  • RE: Problem with settin up Snort on win XP Michael Steele (Dec 15)
• SMTP subject tracking Keith Irvin (Dec 15)
• Strange ICMP traffic. Perhaps a worm? Harry M (Dec 15)
  • Re: Strange ICMP traffic. Perhaps a worm? Shane Smith (Dec 15)
  • <Possible follow-ups>
  • RE: Strange ICMP traffic. Perhaps a worm? adam.w.hogan (Dec 15)
    • Re: Strange ICMP traffic. Perhaps a worm? Jim Brown (Dec 16)
  • RE: Strange ICMP traffic. Perhaps a worm? CGhercoias (Dec 15)
    • RE: Strange ICMP traffic. Perhaps a worm? Jack McCarthy (Dec 15)
• ACID & MySQL (Sensor) David Newsom (Dec 15)
  • RE: ACID & MySQL (Sensor) Michael Steele (Dec 15)
  • <Possible follow-ups>
  • RE: ACID & MySQL (Sensor) David Newsom (Dec 15)
• Import 1 snortdb into another for "1 place monitoring" STEPHEN W. COREY - 5535 (Dec 15)
  • RE: Import 1 snortdb into another for "1 place monitoring" Michael Steele (Dec 15)
• unknown preprocessor "http_inspect" Dirk Sachse (Dec 15)
  • RE: unknown preprocessor "http_inspect" Michael Steele (Dec 15)
  • Re: unknown preprocessor "http_inspect" Ralf Spenneberg (Dec 15)
• exact phrase match Dan (Dec 15)
  • Message not available
    • Re: exact phrase match Matt Kettler (Dec 15)
  • Re: exact phrase match Brian (Dec 15)
    • Re: exact phrase match Paul Schmehl (Dec 15)
      • Re: exact phrase match Brian (Dec 16)
  • Re: exact phrase match Sean Lazar (Dec 15)
    • Re: exact phrase match Divyang Desai (Dec 15)
      • Re: exact phrase match Nerijus Krukauskas (Dec 15)
  • <Possible follow-ups>
  • Re: exact phrase match adam_peterson (Dec 16)
  • Re: exact phrase match Dan (Dec 18)
  • RE: exact phrase match Schmehl, Paul L (Dec 18)
• Cutia sigura Virgil Iancu (Dec 16)
• Not logging ICMP with logto: Toby Rodwell (Dec 16)
• New version of FLoP: 1.0.6 Dirk Geschke (Dec 16)
• rpm installation mysql support Richard Worwood (Dec 16)
  • Re: rpm installation mysql support Daniel Wittenberg (Dec 16)
  • Re: rpm installation mysql support twig les (Dec 16)
• Updating signatures in IDS policy Manager Michael . Mulholland (Dec 17)
  • RE: Updating signatures in IDS policy Manager Jeff Dell (Dec 17)
• Snort Database Joshua R. Jones (Dec 17)
• WEB-MISC ?open access Elena Escolano Torner (Dec 17)
• multiple ports in rule Bryan Irvine (Dec 17)
  • Re: multiple ports in rule Matt Kettler (Dec 17)
• ARP poisoning and sniffing in a Switched Network CGhercoias (Dec 17)
  • Re: ARP poisoning and sniffing in a Switched Network twig les (Dec 17)
• Problem with "Established" keyword Ryan Russell (Dec 17)
  • Re: Problem with "Established" keyword Chris Green (Dec 17)
    • Re: Problem with "Established" keyword Ryan Russell (Dec 17)
      • Re: Problem with "Established" keyword Chris Green (Dec 18)
• Rule order? Toby Rodwell (Dec 17)
  • Re: Rule order? Ralf Spenneberg (Dec 18)
    • W32/Sober.b snort rule jbendure (Dec 18)
• ACID - PHP Mike Koponick (Dec 17)
  • Re: ACID - PHP Daniel A. Melo (Dec 18)
  • Re: ACID - PHP tslighter (Dec 18)
  • RE: ACID - PHP Jerry Shenk (Dec 21)
• Weird stuff when compiling snort w/ MySQL support Michael Chapman (Dec 17)
  • <Possible follow-ups>
  • RE: Weird stuff when compiling snort w/ MySQL support Michael Chapman (Dec 17)
• Another Not IPv4 Datagram Mike Maki (Dec 17)
• CanSecWest/core04 Really Really Last CFP Dragos Ruiu (Dec 17)
• Re:Snort-users digest, Vol 1 #3831 - 5 msgs Richard St John (Dec 17)
• running snort under LIDS Raber (Dec 18)
  • Re: running snort under LIDS Demetri Mouratis (Dec 18)
• Barnyard 0.1.0 and the "unable to find mysqlclient library" issue John Whitson (Dec 18)
  • <Possible follow-ups>
  • Barnyard 0.1.0 and the "unable to find mysqlclient library" issue John Whitson (Dec 30)
• Snort 2.1.0 is now available! Jeremy Hewlett (Dec 18)
  • <Possible follow-ups>
  • re: Snort 2.1.0 is now available! adam_peterson (Dec 18)
  • RE: re: Snort 2.1.0 is now available! Kreimendahl, Chad J (Dec 18)
• Snort 2.0.6 is available! Jeremy Hewlett (Dec 18)
• Snort on Suse linux 9.0 KS (Dec 18)
• bad calculation of the amount of drop Roberto Bosticardo (Dec 18)
• Supress creation of directories by ip Cedric Foll (Dec 18)
  • Re: Supress creation of directories by ip twig les (Dec 18)
• W32/Yaha-Y Worm jbendure (Dec 18)
  • <Possible follow-ups>
  • RE: W32/Yaha-Y Worm CGhercoias (Dec 18)
  • RE: W32/Yaha-Y Worm CGhercoias (Dec 18)
• New Version Timm Schneider (Dec 18)
  • Re: New Version Jeremy Hewlett (Dec 18)
  • <Possible follow-ups>
  • RE: New Version Michael Chapman (Dec 18)
  • RE: New Version Michael Chapman (Dec 18)
    • Re: New Version Timm Schneider (Dec 18)
    • Re: New Version Bennett Todd (Dec 18)
• RE: RE: [Snort-users] re: Snort 2.1.0 is now available! Kreimendahl, Chad J (Dec 18)
  • Re: RE: [Snort-users] re: Snort 2.1.0 is now available! Jacques Brierre (Dec 19)
  • <Possible follow-ups>
  • RE: RE: [Snort-users] re: Snort 2.1.0 is now available! adam_peterson (Dec 18)
• PCRE plugin for exact phrase match Dan (Dec 18)
  • Re: PCRE plugin for exact phrase match Brian (Dec 19)
• snort 2.1.0 does not compile on FreeBSD 4.8 henk (Dec 19)
  • Re: snort 2.1.0 does not compile on FreeBSD 4.8 Bamm Visscher (Dec 19)
    • Re: snort 2.1.0 does not compile on FreeBSD 4.8 Bamm Visscher (Dec 19)
      • Re: Re: [Snort-users] snort 2.1.0 does not compile on FreeBSD 4.8 Jeremy Hewlett (Dec 19)
• Version 2.1.0 -u switch Brian Blake (Dec 19)
• Acid access problem! lsderio lsderio (Dec 19)
  • Re: Acid access problem! Erwin Van de Velde (Dec 19)
  • Re: Acid access problem! Mark Fagan (Dec 22)
  • <Possible follow-ups>
  • RE: Acid access problem! CGhercoias (Dec 19)
• Snort 2.0.5 dropping packets Sheahan, Paul (Dec 19)
  • Message not available
    • Re: Snort 2.0.5 dropping packets Matt Kettler (Dec 19)
• flow and flow-portscan in Snort 2.1 Matthew L. McCarty (Dec 19)
• No alert_smb in 2.1.0? Mike Maki (Dec 19)
  • Re: No alert_smb in 2.1.0? Matt Kettler (Dec 19)
    • Re: No alert_smb in 2.1.0? Frank Knobbe (Dec 20)
      • Re: No alert_smb in 2.1.0? Brian (Dec 20)
      • question about spp stream4 retransmission Michel Christophe (Dec 20)
      • Re: No alert_smb in 2.1.0? Frank Knobbe (Dec 20)
• Snort 2.1.0 with snortcenter v1.0 Friesz, Ross (Dec 19)
  • RE: Snort 2.1.0 with snortcenter v1.0 Jim Cervantes (Dec 19)
• PCRE adam.w.hogan (Dec 19)
  • Re: PCRE Brian (Dec 19)
• snort 2.1.0 compile issues Jeremy Hewlett (Dec 19)
  • Re: snort 2.1.0 compile issues Bamm Visscher (Dec 19)
    • Re: snort 2.1.0 compile issues Jeremy Hewlett (Dec 20)
      • Re: snort 2.1.0 compile issues Henk Wevers (Dec 20)
• MYSQL Error Dan Ferris (Dec 19)
  • Re: MYSQL Error Paul Schmehl (Dec 20)
• ERROR: ERROR /snortcenter/rules/snort.eth0.conf (88): Bad arguments to byte_test: Brian Toovey (Dec 19)
  • Re: ERROR: ERROR /snortcenter/rules/snort.eth0.conf (88): Bad arguments to byte_test: Paul Schmehl (Dec 20)
    • Re: ERROR: ERROR /snortcenter/rules/snort.eth0.conf (88): Bad arguments to byte_test: Brian Toovey (Dec 20)
• problem with Netssl Giannakis Eleftherios (Dec 20)
• ICMP Time-To-Live Exceeded in Transit Erwin Van de Velde (Dec 20)
  • <Possible follow-ups>
  • ICMP Time-To-Live Exceeded in Transit Erwin Van de Velde (Dec 23)
    • Re: ICMP Time-To-Live Exceeded in Transit Edin Dizdarevic (Dec 23)
      • Re: ICMP Time-To-Live Exceeded in Transit Erwin Van de Velde (Dec 23)
      • Re: ICMP Time-To-Live Exceeded in Transit Edin Dizdarevic (Dec 23)
• Snort 2.1.0 + Solaris issues Erek Adams (Dec 21)
  • Re: [Snort-devel] Snort 2.1.0 + Solaris issues Jeremy Hewlett (Dec 21)
• Snort, SuSE, Novell and Ximian Tom Fulton (Dec 21)
  • RE: Snort, SuSE, Novell and Ximian Jerry Shenk (Dec 21)
  • <Possible follow-ups>
  • RE: Snort, SuSE, Novell and Ximian Steve Knoch (Dec 29)
• ICMP L3retriever Ping Özgüç Bayrak (Dec 22)
  • <Possible follow-ups>
  • RE: ICMP L3retriever Ping Jordan, Jason A (Dec 22)
• flow-portscan data Matthew L. McCarty (Dec 22)
  • Re: flow-portscan data Matt Kettler (Dec 22)
    • Re: flow-portscan data Matthew L. McCarty (Dec 22)
• Issue with SNORT running for more that 3-4 days Kumar, Manoj (Dec 22)
• Combining two FreeBSD interfaces using Netgraph, part 2 Richard Bejtlich (Dec 22)
• Fix for 2.1 sp_session.c Kenneth Ingham (Dec 22)
• snort 2.01 + guardian 1.7 and 1.6 problem mik sib (Dec 23)
• Tagged packets in logs Russell Fulton (Dec 23)
  • <Possible follow-ups>
  • RE: Tagged packets in logs Grejda, Eric (Dec 23)
• Flexresp2 installation and configuration Problem RAJNEEL DHOTRE (Dec 23)
  • Re: Flexresp2 installation and configuration Problem Matt Kettler (Dec 23)
  • Re: Flexresp2 installation and configuration Problem Jeff Nathan (Dec 31)
  • <Possible follow-ups>
  • Re: Flexresp2 installation and configuration Problem RAJNEEL DHOTRE (Dec 25)
    • Re: Flexresp2 installation and configuration Problem Matt Kettler (Dec 29)
• Rules Gerson Sampaio (Dec 23)
  • Re: Rules Matt Kettler (Dec 23)
    • Re: Rules Andreas Östling (Dec 23)
  • <Possible follow-ups>
  • RE: Rules CGhercoias (Dec 23)
• Performance again Edin Dizdarevic (Dec 23)
  • Re: Performance again Brian (Dec 23)
    • Re: Performance again Edin Dizdarevic (Dec 23)
      • Re: Performance again Matt Kettler (Dec 23)
      • Re: Performance again Edin Dizdarevic (Dec 23)
      • Re: Performance again Matt Kettler (Dec 23)
      • Re: Performance again Lawrence Reed (Dec 23)
      • Re: Performance again Edin Dizdarevic (Dec 23)
      • Re: Performance again Matt Kettler (Dec 23)
• ERROR /etc/snort/snort.eth1.conf (88): Mike Philip (Dec 23)
  • Re: ERROR /etc/snort/snort.eth1.conf (88): Matt Kettler (Dec 23)
    • Message not available
      • [OT] broken autoresponder to list posts at ofcom.org.uk Matt Kettler (Dec 23)
• Snort mysql with no ip interface snort (Dec 23)
  • <Possible follow-ups>
  • Snort mysql with no ip interface Scott Carpenter (Dec 30)
    • Snor logging to mysql with no ip on monitored interface snort (Dec 31)
• Suppression how-to help Bradberry, John (Dec 23)
• Access is denied Takisha Harper (Dec 23)
• BAD-TRAFFIC loopback traffic Alert is NOW TFTPGET passwd Matthew L. McCarty (Dec 23)
• RE: BAD-TRAFFIC loopback SRH-Lists (Dec 23)
• Help to configure SNORT Lorenzo Rossi (Dec 23)
  • Re: Help to configure SNORT Matt Kettler (Dec 23)
    • Re: Help to configure SNORT Lorenzo Rossi (Dec 23)
      • Re: Help to configure SNORT Matt Kettler (Dec 24)
  • <Possible follow-ups>
  • Help to configure SNORT Lorenzo Rossi (Dec 30)
• heavily switched networks Stewart Larsen (Dec 23)
  • Re: heavily switched networks twig les (Dec 23)
    • Re: heavily switched networks Stewart Larsen (Dec 24)
      • Re: heavily switched networks Erek Adams (Dec 24)
      • Re: heavily switched networks Stewart Larsen (Dec 24)
      • Re: heavily switched networks Erek Adams (Dec 24)
      • Re: heavily switched networks twig les (Dec 24)
  • <Possible follow-ups>
  • heavily switched networks Russell Fulton (Dec 24)
• Problem with snort 2.1.0 and redhat 9 Lang Hoang (Dec 23)
  • Re: Problem with snort 2.1.0 and redhat 9 Erek Adams (Dec 24)
  • <Possible follow-ups>
  • RE: Problem with snort 2.1.0 and redhat 9 Lang Hoang (Dec 24)
    • RE: Problem with snort 2.1.0 and redhat 9 Erek Adams (Dec 24)
    • Bad Traffic, Port 0 Martin Bündgens (Dec 24)
      • Re: Bad Traffic, Port 0 Matt Kettler (Dec 24)
      • Re: Bad Traffic, Port 0 Stewart Larsen (Dec 24)
      • Re: Bad Traffic, Port 0 Martin Bündgens (Dec 24)
      • Re: Bad Traffic, Port Josh Berry (Dec 24)
      • Re: Bad Traffic, Port Martin Bündgens (Dec 24)
      • Re: Bad Traffic, Port 0 Erwin Van de Velde (Dec 25)
• error: unknown keyword resp agnelo d (Dec 23)
• compiling snort 2.1 Victor Lamptey (Dec 24)
• Wanting to run Snort on DMZ Michael Thompson (Dec 24)
  • Re: Wanting to run Snort on DMZ Josh Berry (Dec 24)
• Re: 2 Wanting to run Snort on DMZ mike (Dec 24)
• Snort on home DSL connection Bell, Josh (Dec 24)
  • Re: Snort on home DSL connection Erek Adams (Dec 25)
  • <Possible follow-ups>
  • RE: Snort on home DSL connection Bell, Josh (Dec 28)
• Snort-Snmp Glenn Mansfield Keeni (Dec 25)
• snort: unknown keyword resp agnelo d (Dec 25)
  • <Possible follow-ups>
  • snort: unknown keyword resp Avinash K (Dec 28)
• snort speed snort (Dec 26)
  • Re: snort speed Matt Kettler (Dec 29)
• error : unknown keyword resp Agnelo D'souza (Dec 26)
• Build problem (Snort 2.1.0, pcre 4.3) Jeff Kell (Dec 27)
• Help with config Michael Thompson (Dec 28)
  • Re: Help with config Rich Adamson (Dec 28)
  • Re: Help with config peter (Dec 28)
• droped packets khaled fawzy (Dec 28)
  • Re: droped packets Matt Kettler (Dec 29)
• Snort is not logging my port scans Abe Froman (Dec 28)
• Snort not logging port scans Abe Froman (Dec 28)
• Snort restart? Özgüç Bayrak (Dec 29)
  • Re: Snort restart? Edin Dizdarevic (Dec 29)
• SWATCH or a program to send the alerts to my mail! soldier Mx (Dec 29)
  • Re: SWATCH or a program to send the alerts to my mail! Edin Dizdarevic (Dec 29)
• Is it an real attack ? RSA (Dec 29)
  • <Possible follow-ups>
  • Re: Is it an real attack ? Nigel Houghton (Dec 29)
• Choosing Linux Platform for a Snort deployment John Cunningham (Dec 29)
  • Re: Choosing Linux Platform for a Snort deployment Bennett Todd (Dec 29)
• CyberKit 2.2 Ping, its driven me Nuts.. Chris N (Dec 29)
  • Re: CyberKit 2.2 Ping, its driven me Nuts.. Roberto Suarez Soto (Dec 29)
  • Re: CyberKit 2.2 Ping, its driven me Nuts.. Erwin Van de Velde (Dec 29)
  • Re: CyberKit 2.2 Ping, its driven me Nuts.. Bryan Irvine (Dec 29)
    • Re: CyberKit 2.2 Ping, its driven me Nuts.. Erwin Van de Velde (Dec 29)
      • Re: CyberKit 2.2 Ping, its driven me Nuts.. Erwin Van de Velde (Dec 29)
      • RE: CyberKit 2.2 Ping, its driven me Nuts.. Michael Steele (Dec 29)
      • Re: CyberKit 2.2 Ping, its driven me Nuts.. Bryan Irvine (Dec 29)
  • SUMMARY, CyberKit 2.2 Ping, its driven me Nuts.. Chris N (Dec 31)
    • Re: SUMMARY, CyberKit 2.2 Ping, its driven me Nuts.. Jeff Kell (Dec 31)
  • <Possible follow-ups>
  • RE: CyberKit 2.2 Ping, its driven me Nuts.. CMartin (Dec 29)
    • RE: CyberKit 2.2 Ping, its driven me Nuts.. Bryan Irvine (Dec 29)
  • Re: CyberKit 2.2 Ping, its driven me Nuts.. dlbox (Dec 29)
  • RE: CyberKit 2.2 Ping, its driven me Nuts.. Thompson, Jimi (Dec 29)
    • Re: CyberKit 2.2 Ping, its driven me Nuts.. Matthew L. McCarty (Dec 29)
  • Re: CyberKit 2.2 Ping, its driven me Nuts.. Alexander Hampel (Dec 29)
  • RE: CyberKit 2.2 Ping, its driven me Nuts.. CGhercoias (Dec 29)
  • Re: CyberKit 2.2 Ping, its driven me Nuts.. lindsay . hunt (Dec 30)
• Snortsam / Portscanning Detection Tuomas Groves (Dec 29)
  • Re: Snortsam / Portscanning Detection Frank Knobbe (Dec 29)
  • Re: Snortsam / Portscanning Detection christian graf (Dec 31)
• SID 1841 Romano, Chris (Dec 29)
  • <Possible follow-ups>
  • SID 1841 Romano, Chris (Dec 29)
• Snort 2.1 Problems with unicode.map Mark Totsch (Dec 29)
  • Re: Archive? Jeff Kell (Dec 29)
  • <Possible follow-ups>
  • RE: Snort 2.1 Problems with unicode.map CMartin (Dec 29)
  • RE: Snort 2.1 Problems with unicode.map STEPHEN W. COREY - 5535 (Dec 30)
• IDS Robert A. Desautels (Dec 29)
  • Re: IDS Matthew L. McCarty (Dec 29)
  • Re: IDS ***Spoofed Message*** Adriel T. Desautels (Dec 29)
• xml plugin Neal Timm (Dec 29)
• error in webmin agnelo d (Dec 29)
  • <Possible follow-ups>
  • RE: error in webmin Shaffer, Paul D (Dec 30)
• WinSnort and MSSQL Problem Uso (Dec 30)
  • RE: WinSnort and MSSQL Problem Michael Steele (Dec 30)
  • Re: WinSnort and MSSQL Problem Uso (Dec 30)
    • RE: WinSnort and MSSQL Problem Michael Steele (Dec 30)
      • Re: WinSnort and MSSQL Problem Uso (Dec 30)
      • Message not available
      • Re: WinSnort and MSSQL Problem Brice B (Dec 30)
      • RE: WinSnort and MSSQL Problem Michael Steele (Dec 31)
  • <Possible follow-ups>
  • RE: WinSnort and MSSQL Problem snortmail (Dec 30)
    • RE: WinSnort and MSSQL Problem Chris Reid (Dec 30)
      • RE: WinSnort and MSSQL Problem Michael Steele (Dec 30)
  • RE: WinSnort and MSSQL Problem Majwabu, Richard (Dec 31)
  • RE: WinSnort and MSSQL Problem Shaffer, Paul D (Dec 31)
    • RE: WinSnort and MSSQL Problem Michael Steele (Dec 31)
• Snort Upgrade and Flexresp Aryan D (Dec 30)
• ID'ing loopback spoof Blake.Fithen (Dec 30)
• Win32 Error: service is not responding to the control function Michael Steele (Dec 30)
  • <Possible follow-ups>
  • Win32 Error: service is not responding to the control function michaels (Dec 30)
  • RE: Win32 Error: service is not responding to the control function snortmail (Dec 30)
• where can I find ms_unicode_generator.c for snort-2.1.0 Koay Y.Chen (Dec 30)
• SNORT Fortune 1000 auto17766 (Dec 30)
  • <Possible follow-ups>
  • Re: SNORT Fortune 1000 tetsujin (Dec 31)
• (http\_inspect) NON-RFC DEFINED CHAR Martin Hess (Dec 30)
  • <Possible follow-ups>
  • RE: (http\_inspect) NON-RFC DEFINED CHAR CMartin (Dec 30)
    • Re: (http\_inspect) NON-RFC DEFINED CHAR Jeff Kell (Dec 30)
  • FW: (http\_inspect) NON-RFC DEFINED CHAR CMartin (Dec 30)
    • Re: FW: (http\_inspect) NON-RFC DEFINED CHAR Jeff Kell (Dec 30)
• rule in web-iis.rules causes snort 2.0.0 to die Crowell, Gary (Dec 30)
• Snort - mysql configuration missing mysql.h header files obelknobe 1 (Dec 30)
• spp_portscan2 and 2.0.6 Ron Shuck (Dec 30)
• snort 2.1.0 + OpenBSD = no compile spoofy (Dec 30)
  • Re: snort 2.1.0 + OpenBSD = no compile Dirk Geschke (Dec 30)
• heavily switched network questions Stewart Larsen (Dec 30)
  • Re: heavily switched network questions Josh Berry (Dec 31)
  • <Possible follow-ups>
  • Re: heavily switched network questions Josh Berry (Dec 30)
  • RE: heavily switched network questions SRH-Lists (Dec 31)
• Managing many sensors robert schwartz (Dec 30)
• Bus error on Solaris/Sparc with spo_database.c Paul van Empelen (Dec 30)
• Re: Snort-users digest, Vol 1 #3857 - 5 msgs adam_peterson (Dec 30)
• ATTACK-RESPONSES id check returned root Romano, Chris (Dec 30)
  • Re: ATTACK-RESPONSES id check returned root sam (Dec 30)
• Thresholding the Cyberkit ICMP Ping rule Brice B (Dec 30)
• Anybody using the react keyword in 2.1? David Gianndrea (Dec 31)
• RE: SUMMARY, CyberKit 2.2 Ping, its driven me Nuts.. bmcdowell (Dec 31)
• RE: Snor logging to mysql with no ip on monitored interface Shaffer, Paul D (Dec 31)
  • RE: Snor logging to mysql with no ip on monitored interface Michael Steele (Dec 31)
• Http_inspect: allow_proxy_use/no_alerts Martin McKeay (Dec 31)
• RE: Snor logging to mysql with no ip on monitored i nterface CMartin (Dec 31)
  • RE: Snort logging to mysql with no ip on monitored interface snort (Dec 31)
    • RE: Snort logging to mysql with no ip on monitored interface snort (Dec 31)
      • RE: Snort logging to mysql with no ip on monitored interface snort (Dec 31)
• TCP Data Offset is less than 5 Gabriel L. Somlo (Dec 31)
• Threshold settings Jeff Kell (Dec 31)
• Oinkmaster Oddity Thompson, Jimi (Dec 31)
• re: http\_inspect alerts adam_peterson (Dec 31)
  • <Possible follow-ups>
  • RE: re: http\_inspect alerts CMartin (Dec 31)
  • re: http\_inspect alerts adam_peterson (Dec 31)
  • RE: http\_inspect alerts CMartin (Dec 31)

Previous period

Next period