Snort: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

1805 messages starting Mar 31 04 and ending Jun 30 04
Date index | Thread index | Author index

• RE: WinSNORT: PHP and MSSQL problem: Pleaserecompile PHP with the necessary library (--enable-mssql) Michael Steele (Mar 31)
• RE: TCP and ACID Michael Steele (Mar 31)
  • <Possible follow-ups>
  • RE: TCP and ACID Kromodimedjo, John (Apr 01)
  • Re: TCP and ACID Shawn Kottke (Apr 01)
  • RE: TCP and ACID Thompson, Jimi (Apr 02)
  • RE: TCP and ACID Kromodimedjo, John (Apr 02)
• Re: Reconstruction of TCP packets Rajesh Joseph (Mar 31)
• Re: how to block P2P with snort Ravi (Mar 31)
  • Re: how to block P2P with snort Sylvain BERTRAND (Apr 01)
  • snort tables (mysql) Cesar (May 19)
• Re: Problem Compiling 2.1.1 on FreeBSD 5.1-RELEASE eric-dated-1083277626 . 193075aa63e273 (Mar 31)
  • source address of 127.0.0.1 Zeeshan Ahmed (Mar 31)
• 127.0.0.1 Snort Man (Mar 31)
  • Re: 127.0.0.1 Edin Dizdarevic (Apr 01)
  • SNORT Plugin to block the traffic Zeeshan Ahmed (Apr 01)
    • Re: SNORT Plugin to block the traffic Matt Kettler (Apr 01)
      • Re: SNORT Plugin to block the traffic Michael Sconzo (Apr 01)
      • Re: SNORT Plugin to block the traffic Ravi (Apr 02)
      • Re: SNORT Plugin to block the traffic Matt Kettler (Apr 02)
      • snortsam trouble bonnie (Apr 27)
• old snort log Fabrizio Tivano (Apr 01)
• SnortInline - Barnyard - no ipheader & payload Jochen Vogel (Apr 01)
• Yahoo Mesengger Muhammad Reza (Apr 01)
• Re: OpenSource Alternative to SourceFire's RNA AJ Butcher, Information Systems and Computing (Apr 01)
  • <Possible follow-ups>
  • Re: OpenSource Alternative to SourceFire's RNA Andy Cuff (Apr 05)
• OpenAanval Intrusion Detection Console problem faizaln (Apr 01)
  • <Possible follow-ups>
  • Re: OpenAanval Intrusion Detection Console problem James Nonya (Apr 01)
  • Re: OpenAanval Intrusion Detection Console problem faizaln (Apr 01)
    • Re: OpenAanval Intrusion Detection Console problem Alejandro Flores (Apr 01)
  • RE: OpenAanval Intrusion Detection Console problem Miller, Travis P. (Apr 05)
  • RE: OpenAanval Intrusion Detection Console problem Tobias Rice (Apr 05)
• looking for applications Gema de Toro Sánchez (Apr 01)
• Spool Processors Gary_Portnoy (Apr 01)
  • Re: Spool Processors Dirk Geschke (Apr 01)
    • Re: Spool Processors Josh Berry (Apr 01)
  • <Possible follow-ups>
  • Re: Spool Processors Gary_Portnoy (Apr 01)
    • Re: Spool Processors Dirk Geschke (Apr 01)
• Anyone ever use Harvester? Jason Humes (Apr 01)
• Using ACID for SNMP and SYSLOG messages? Jason Humes (Apr 01)
• Question about http_insepct Thomas Bechtold (Apr 01)
  • Re: Question about http_insepct Daniel J. Roelker (Apr 05)
• (no subject) eric-dated-1083277626 . 193075aa63e273 (Apr 01)
  • Re: (no subject) Michael Sconzo (Apr 01)
  • <Possible follow-ups>
  • RE: (no subject) SRH-Lists (Apr 01)
  • (no subject) Christian Morales (Apr 07)
  • (no subject) Nitin KAPOOR (May 02)
  • (no subject) Nitin KAPOOR (May 02)
  • (no subject) ac107029 (May 07)
  • (no subject) Mike Cohen (Jun 05)
    • upriviileged snort user (was Re: (no subject)) Ken Gunderson (Jun 06)
      • Re: upriviileged snort user (was Re: (no subject)) Dirk Geschke (Jun 06)
    • Re: (no subject) Matt Kettler (Jun 07)
      • Re: (no subject) Mike Cohen (Jun 07)
      • Re: (no subject) Matt Kettler (Jun 07)
  • (no subject) Michael Shirk (Jun 07)
  • (no subject) Zurt (Jun 16)
• OSSIM? Jason Humes (Apr 01)
  • RE: OSSIM? Lior (Apr 07)
• [Snort-Users] differentiate between eth0 and eth1 eamonn doyle (Apr 01)
  • Re: [Snort-Users] differentiate between eth0 and eth1 Alejandro Flores (Apr 01)
• Simple FTP login request rule - just not so simple to me! JPP (Apr 01)
  • Re: Simple FTP login request rule - just not so simple to me! Matt Kettler (Apr 01)
    • Re: Simple FTP login request rule - just not so simple to me! JPP (Apr 01)
• Snort / ACID problem Perrymon, Josh L. (Apr 01)
  • RE: Snort / ACID problem Jim Cervantes (Apr 01)
• [Snort-Users] differentiate between eth0 and eth1 in logs eamonn doyle (Apr 01)
  • RE: [Snort-Users] differentiate between eth0 and eth1 in logs Jim Hendrick (Apr 02)
    • RE: [Snort-Users] differentiate between eth0 and eth1 in logs Matt Kettler (Apr 02)
  • Re: [Snort-Users] differentiate between eth0 and eth1 in logs Edin Dizdarevic (Apr 02)
    • Re: [Snort-Users] differentiate between eth0 and eth1 in logs eamonn doyle (Apr 02)
• Installing Snort on OpenBSD based on RH WS3 or FreeBSD doc's on snort site Jacob, Raymond A Jr (Apr 01)
  • RE: Installing Snort on OpenBSD based on RH WS3 or FreeBSD doc's on snort site robert schwartz (Apr 01)
• RE: Simple FTP Login Request rule......................... JPP (Apr 01)
• OSSIM Installation Altrock, Jens (Apr 01)
  • Re: OSSIM Installation AJ Butcher, Information Systems and Computing (Apr 02)
• snortsam.conf.sample Zeeshan Ahmed (Apr 02)
  • Re: snortsam.conf.sample Frank Knobbe (Apr 02)
• AW: OSSIM Installation Altrock, Jens (Apr 02)
  • Re: AW: OSSIM Installation AJ Butcher, Information Systems and Computing (Apr 02)
• arpwatch patch no ipv4 url ? ( auto rule assignment project) Sean Wheeler (Apr 02)
  • Re: arpwatch patch no ipv4 url ? ( auto rule assignment project) AJ Butcher, Information Systems and Computing (Apr 02)
• HELP: Error MSSQL and ACID Kromodimedjo, John (Apr 02)
  • RE: HELP: Error MSSQL and ACID Michael Steele (Apr 02)
  • <Possible follow-ups>
  • RE: HELP: Error MSSQL and ACID Kromodimedjo, John (Apr 02)
• ARP Spoof does not show MAC Kim Wall (Apr 02)
  • Re: ARP Spoof does not show MAC Stephen W. Thompson (Apr 02)
  • <Possible follow-ups>
  • ARP Spoof does not show MAC Kim Wall (Apr 05)
• Missing table for Acid and Snort William Hillis (Apr 02)
• Snort + acid + mysql Nils Fragoso (Apr 02)
  • Re: Snort + acid + mysql Patrick S. Harper - CISSP RHCT MCSE (Apr 06)
  • <Possible follow-ups>
  • RE: Snort + acid + mysql Michael Miller (Apr 02)
  • RE: Snort + acid + mysql Noble, Kevin (Apr 02)
• RE: fin-no-ack scans Fred Portnoy (Apr 02)
• Barnyard snorts, but no Alerts cached Michael Miller (Apr 02)
  • Re: Barnyard snorts, but no Alerts cached Andrew R. Baker (Apr 03)
• ghosting a snort server??? Pat Delaney (Apr 03)
  • <Possible follow-ups>
  • RE: ghosting a snort server??? Jordan, Jason A (Apr 03)
  • RE: ghosting a snort server??? Pat Delaney (Apr 03)
  • RE: ghosting a snort server??? hugh_fraser (Apr 04)
• Startup Problem eric-dated-1083277626 . 193075aa63e273 (Apr 03)
  • Re: Startup Problem Michael Boman (Apr 05)
• Need help in interpreting port scans. cg16uy (Apr 04)
• VLAN Tagged Traffic - Some being missed Aaron (Apr 04)
  • <Possible follow-ups>
  • Re: VLAN Tagged Traffic - Some being missed Mark . Schutzmann (Apr 05)
  • Re: VLAN Tagged Traffic - Some being missed Mark . Schutzmann (Apr 05)
• Using BPF Filters for GRE, OSPF, BGP, IGMP Aaron (Apr 04)
  • Re: Using BPF Filters for GRE, OSPF, BGP, IGMP Frank Knobbe (Apr 04)
    • Re: Using BPF Filters for GRE, OSPF, BGP, IGMP Aaron (Apr 04)
      • Re: Using BPF Filters for GRE, OSPF, BGP, IGMP Frank Knobbe (Apr 05)
• Event supression problem Zphosis De Extrodinaire (Apr 04)
  • Re: Event supression problem Zphosis De Extrodinaire (Apr 04)
    • Re: Event supression problem Nerijus Krukauskas (Apr 05)
• Layer 2 Rules Capability Kim Wall (Apr 04)
  • Re: Layer 2 Rules Capability Matt Kettler (Apr 05)
• Acid Archive Error Kalajzich, Damon (Apr 04)
• please helpe-me IDS snort Alessandro Wesley (Apr 05)
  • Re: please helpe-me IDS snort pheusion () snet net (Apr 05)
• local.rules problem zeineb sellami (Apr 05)
• RE: Cisco Device Exploit Perl Script Jason Truong (Apr 05)
• Snort is running, what else can I do now? Fragoso, Nils (Copenhagen) (Apr 05)
• Algorithm Josh Berry (Apr 05)
• Rules with multiple contents specified gurmeet singh (Apr 05)
  • Re: Rules with multiple contents specified Alejandro Flores (Apr 05)
• RE: Snort 2.1.0 with snortcenter v1.0 Markus . Becker (Apr 05)
• snort/mudpit - status Maetzky (extern) (Apr 05)
  • <Possible follow-ups>
  • RE: snort/mudpit - status Truax, Shawn (MBS) (Apr 06)
• Re: Snort en mode NIDS sanaâ Aitouchen (Apr 05)
  • <Possible follow-ups>
  • Re: Snort en mode NIDS Mark . Schutzmann (Apr 05)
  • Re: Snort en mode NIDS sanaâ Aitouchen (Apr 07)
• Snortcenter: "No Update This Time" M. Morgan (Apr 05)
  • Re: Snortcenter: "No Update This Time" AJ Butcher, Information Systems and Computing (Apr 06)
• W32 Welchia.Nachi? Wichman, Larry (Apr 05)
  • W32 Welchia.Nachi? Mark Gilbert (Apr 05)
• Archiving In Acid Kalajzich, Damon (Apr 05)
• Customizing snort rules simonkc (Apr 06)
  • Re: Customizing snort rules Edin Dizdarevic (Apr 06)
  • Re: Customizing snort rules AJ Butcher, Information Systems and Computing (Apr 06)
  • Re: Customizing snort rules Rodrigo B. Ramos (Apr 07)
  • <Possible follow-ups>
  • RE: Customizing snort rules simonkc (Apr 06)
    • Re: Customizing snort rules Edin Dizdarevic (Apr 06)
• Using Snort & DB to remove false alarms Sean Wheeler (Apr 06)
  • Re: Using Snort & DB to remove false alarms Michael Boman (Apr 07)
  • <Possible follow-ups>
  • RE: Using Snort & DB to remove false alarms Kreimendahl, Chad J (Apr 06)
    • RE: Using Snort & DB to remove false alarms Jason Haar (Apr 06)
      • Re: Using Snort & DB to remove false alarms Brian (Apr 06)
      • Re: Using Snort & DB to remove false alarms Jason Haar (Apr 06)
  • RE: Using Snort & DB to remove false alarms Kreimendahl, Chad J (Apr 07)
  • RE: Using Snort & DB to remove false alarms Kreimendahl, Chad J (Apr 08)
• SnortCenter+Sensor problem Naveen C Joshi (Apr 06)
  • Re: SnortCenter+Sensor problem AJ Butcher, Information Systems and Computing (Apr 06)
    • RE: SnortCenter+Sensor problem Naveen C Joshi (Apr 07)
• Snort "Feel-Good" Mark . Schutzmann (Apr 06)
  • Re: Snort "Feel-Good" AJ Butcher, Information Systems and Computing (Apr 07)
• display/log IPv6 traffic Akolinare (Apr 06)
• New SUG established Schmehl, Paul L (Apr 06)
• Snort database problem Laura (Apr 06)
  • Re: Snort database problem Dirk Geschke (Apr 06)
  • Re: Snort database problem Mark Fagan (Apr 06)
  • RE: Snort database problem Michael Steele (Apr 06)
  • Re: Snort database problem Michael Boman (Apr 07)
  • <Possible follow-ups>
  • RE: Snort database problem Hutchinson, Andrew (Apr 06)
• Binding snort to multiple interfaces eric-dated-1083277626 . 193075aa63e273 (Apr 06)
  • <Possible follow-ups>
  • Binding snort to multiple interfaces heric-dated-1083277626 . 193075aa63e273 (Apr 07)
  • RE: Binding snort to multiple interfaces Patrick Harper (Apr 07)
    • Re: Binding snort to multiple interfaces eamonn doyle (Apr 07)
      • Re: Binding snort to multiple interfaces eric-dated-1083277626 . 193075aa63e273 (Apr 07)
      • Re: Binding snort to multiple interfaces Rolf A. Vaglid (Apr 07)
    • Re: Binding snort to multiple interfaces eric-dated-1083277626 . 193075aa63e273 (Apr 07)
      • Re: Binding snort to multiple interfaces Max Valdez (Apr 17)
• Re: Announce: FLoP-1.2.0 AJ Butcher, Information Systems and Computing (Apr 07)
  • Re: Re: [Snort-users] Announce: FLoP-1.2.0 Dirk Geschke (Apr 07)
• What Might I have Missed? RH72, Snort, MySql, PHP, Adodb, Acid Bruce D. meyer (Apr 07)
  • Re: What Might I have Missed? RH72, Snort, MySql, PHP, Adodb, Acid Alejandro Flores (Apr 07)
• snort sanaâ Aitouchen (Apr 07)
• problem creating database Laura del Pino (Apr 07)
  • Re: problem creating database Frank Meerkoetter (Apr 07)
  • <Possible follow-ups>
  • RE: problem creating database Patrick Harper (Apr 07)
  • RE: problem creating database Che Wan Zaharudin (Apr 07)
• snort locked into using one signature Spencer Anderson (Apr 07)
  • <Possible follow-ups>
  • Re: snort locked into using one signature James Nonya (Apr 07)
    • Re: snort locked into using one signature Matt Kettler (Apr 07)
• Are there any rules for the new W32.Gaobot.WX worms? Lin Zhong (Apr 07)
• remote sensor config Zondlo, Zack (Apr 07)
  • <Possible follow-ups>
  • RE: remote sensor config Che Wan Zaharudin (Apr 07)
    • RE: remote sensor config AJ Butcher, Information Systems and Computing (Apr 08)
• upgrade from snort 2.0.1 -> 2.1.2: guardian blocks common http access Walter Joman (Apr 07)
• What Might I have Missed? RH72, Snort, MySql,PHP, Adodb, Acid Bruce D. meyer (Apr 07)
  • Re: What Might I have Missed? RH72, Snort, MySql,PHP, Adodb, Acid Alejandro Flores (Apr 08)
• Warning*: session_start() Jacob, Raymond A Jr (Apr 07)
• RE: Warning*: session_start() solved I think it was a chroot issue in OpenBSD once Jacob, Raymond A Jr (Apr 07)
• acid on windows agnelo d (Apr 08)
  • RE: acid on windows Michael Steele (Apr 08)
  • <Possible follow-ups>
  • RE: acid on windows Jim Clews (Apr 08)
• 2.1.2 dropping packets Stuart Archer (Apr 08)
• Dynamic IP address and Sensor Id Robert Hendrickx (Apr 08)
  • Re: Dynamic IP address and Sensor Id Nerijus Krukauskas (Apr 08)
• Snort testing David Nardoni (Apr 08)
  • <Possible follow-ups>
  • RE: Snort testing Patrick Harper (Apr 08)
• Snort on Windows problem Aijaz Ahmed (Apr 08)
  • RE: Snort on Windows problem Paul Martin (Apr 08)
• Snort running but no alert show in ACID michela.gandolfo_external (Apr 08)
• libmysqlclient.so.12 Gary Borgeson (Apr 08)
  • Re: libmysqlclient.so.12 Dirk Geschke (Apr 08)
  • Re: libmysqlclient.so.12 Nicholas Brawn (Apr 09)
  • <Possible follow-ups>
  • Fw: libmysqlclient.so.12 SNORT (Apr 09)
• new product integrating snort and nessus Neal Timm (Apr 08)
• Acid database Error William Hillis (Apr 08)
  • Re: Acid database Error Josh Berry (Apr 08)
• snort_archive and snort_log dbnames in acid Jacob, Raymond A Jr (Apr 08)
  • <Possible follow-ups>
  • RE: snort_archive and snort_log dbnames in acid Harper, Patrick (Apr 08)
• Setting up notifications in Snort Paul Martin (Apr 08)
  • <Possible follow-ups>
  • RE: Setting up notifications in Snort Harper, Patrick (Apr 08)
    • RE: Setting up notifications in Snort Alan (Apr 09)
    • RE: Setting up notifications in Snort Alan (Apr 09)
  • RE: Setting up notifications in Snort Noble, Kevin (Apr 09)
• Is there a contrib/create_mysql script to create the snort_archive database and an acid option to schedule archiving? Jacob, Raymond A Jr (Apr 08)
• Signatures, priorities and database Dirk Geschke (Apr 08)
• ACID Search/Filter Questions McCash, John (Apr 08)
• Monitoring multiple devices with SNORT David Nardoni (Apr 09)
  • <Possible follow-ups>
  • RE: Monitoring multiple devices with SNORT Truax, Shawn (MBS) (Apr 09)
  • RE: Monitoring multiple devices with SNORT Harper, Patrick (Apr 12)
• Howto clean Snort mysql logs Olivier PERROT (Apr 09)
• Flow-portscan configuration how-to Guillaume Arcas (Apr 09)
• WatchHog Released - a web-based snort alert analyser. Randy Walinga (Apr 09)
  • Re: WatchHog Released - a web-based snort alert analyser. Paul Schmehl (Apr 10)
    • RE: WatchHog Released - a web-based snort alert analyser. Michael Steele (Apr 10)
    • RE: WatchHog Released - a web-based snort alert analyser. Randy Walinga (Apr 10)
  • <Possible follow-ups>
  • Re: WatchHog Released - a web-based snort alert analyser. Mark . Schutzmann (Apr 09)
    • RE: WatchHog Released - a web-based snort alert analyser. Randy Walinga (Apr 09)
• ignore host? MEGA Hospedagem (Apr 10)
  • Re: ignore host? eric-dated-1083277626 . 193075aa63e273 (Apr 10)
    • Re[2]: ignore host? MEGA Hospedagem (Apr 10)
      • Re: ignore host? eric-dated-1083277626 . 193075aa63e273 (Apr 10)
      • RE: ignore host? Randy Walinga (Apr 10)
  • Re: ignore host? Andreas Östling (Apr 10)
• Portscan Detection eric-dated-1083277626 . 193075aa63e273 (Apr 10)
• SSL traffic Frank Dobb (Apr 10)
  • Re: SSL traffic eric-dated-1083277626 . 193075aa63e273 (Apr 10)
    • Re: SSL traffic Jason Haar (Apr 11)
  • Re: SSL traffic Frank Meerkoetter (Apr 10)
  • <Possible follow-ups>
  • SSL traffic Frank Dobb (Apr 12)
  • RE: SSL traffic Harper, Patrick (Apr 12)
• Some worm? Jan Hugo Prins (Apr 11)
  • Message not available
    • Re: Some worm? Matt Kettler (Apr 12)
• ruleset priority Brian D. Hamm (Apr 12)
• IDS provisioning site analysis tool? Williams Jon (Apr 12)
  • RE: IDS provisioning site analysis tool? Jerry Shenk (Apr 12)
  • Re: IDS provisioning site analysis tool? Martin Roesch (Apr 13)
  • <Possible follow-ups>
  • RE: IDS provisioning site analysis tool? Williams Jon (Apr 13)
    • Re: IDS provisioning site analysis tool? Martin Roesch (Apr 13)
• Flow-portscan oddity Kreimendahl, Chad J (Apr 12)
  • Re: Flow-portscan oddity Guillaume Arcas (Apr 12)
    • Re: Flow-portscan oddity Martin Roesch (Apr 13)
      • Re: Flow-portscan oddity Guillaume Arcas (Apr 13)
  • <Possible follow-ups>
  • RE: Flow-portscan oddity Kreimendahl, Chad J (Apr 13)
  • RE: Flow-portscan oddity Douglas McCrea (Apr 13)
    • RE: Flow-portscan oddity Todd_Pratt (Apr 13)
  • RE: Flow-portscan oddity Kreimendahl, Chad J (Apr 13)
    • RE: Flow-portscan oddity Todd_Pratt (Apr 14)
  • RE: Flow-portscan oddity Dusty Hall (Apr 14)
  • RE: Flow-portscan oddity Douglas McCrea (Apr 14)
    • Re: Flow-portscan oddity Chris Green (Apr 14)
  • RE: Flow-portscan oddity Jasmine CHUA (Apr 15)
• output database - log vs. alert Zondlo, Zack (Apr 12)
• multiple instances, three nics, one box Zondlo, Zack (Apr 12)
  • Re: multiple instances, three nics, one box Bennett Todd (Apr 12)
• ubject: Norman Internet Protection - Malware Warning! jhaar (Apr 13)
  • <Possible follow-ups>
  • ubject: Norman Internet Protection - Malware Warning! jhaar (Apr 13)
• Hot XXX Streaming Videos, FREE Clips jhaar (Apr 13)
  • RE: Hot XXX Streaming Videos, FREE Clips General Information (Apr 13)
• Error DESH SRIVASTAVA (Apr 13)
  • Re: Error Edin Dizdarevic (Apr 13)
  • Re: Error Matt Kettler (Apr 13)
• Re: Snort-users digest, Vol 1 #4136 - 8 msgs Donald G Meyett (Apr 13)
• Snort's Processing Rate Sherif Yusuf (Apr 13)
  • Re: Snort's Processing Rate Matt Kettler (Apr 13)
  • <Possible follow-ups>
  • RE: Snort's Processing Rate Matt Gibson (Apr 13)
  • RE: Snort's Processing Rate Kreimendahl, Chad J (Apr 13)
  • RE: Snort's Processing Rate Bob Walder (Apr 14)
• Chat/IM Rowland, Krisa W ERDC-ITL-MS Contractor (Apr 13)
  • Message not available
    • Re: Chat/IM Matt Kettler (Apr 13)
  • <Possible follow-ups>
  • RE: Chat/IM Rowland, Krisa W ERDC-ITL-MS Contractor (Apr 13)
  • RE: Chat/IM Harper, Patrick (Apr 13)
    • Re: Chat/IM Remko Lodder (Apr 13)
      • Re: Chat/IM Craig Paterson (Apr 13)
      • Re: Chat/IM Bryan Irvine (Apr 13)
  • RE: Chat/IM Harper, Patrick (Apr 13)
  • RE: Chat/IM Larry Pitcher (Apr 13)
  • Re: Chat/IM Mark . Schutzmann (Apr 14)
  • RE: Chat/IM Rowland, Krisa W ERDC-ITL-MS Contractor (Apr 14)
  • RE: Chat/IM Lyons, Jon (Apr 14)
    • RE: Chat/IM Joe Thompson (Apr 15)
• Using Snort with WhatsUp Gold? Paul Martin (Apr 13)
  • Re: Using Snort with WhatsUp Gold? Guillaume Arcas (Apr 13)
• Free Security product nt (Apr 13)
• Fw: Lesbian Mpeg jhaar (Apr 13)
  • <Possible follow-ups>
  • RE: Fw: Lesbian Mpeg Harper, Patrick (Apr 14)
    • RE: Fw: Lesbian Mpeg Randy Walinga (Apr 14)
    • Re: Fw: Lesbian Mpeg jon baer (Apr 14)
    • RE: Fw: Lesbian Mpeg Keith Loyd (Apr 14)
  • RE: Fw: Lesbian Mpeg Joe Matusiewicz (Apr 14)
  • RE: Fw: Lesbian Mpeg Brian F. Vaughan (Apr 14)
  • RE: Fw: Lesbian Mpeg SRH-Lists (Apr 14)
    • RE: Fw: Lesbian Mpeg Dave Dearinger (Apr 15)
  • RE: Fw: Lesbian Mpeg Mark . Schutzmann (Apr 14)
    • Re: Fw: Lesbian Mpeg Jason Haar (Apr 15)
      • Re: Fw: Lesbian Mpeg James Riden (Apr 15)
  • RE: Fw: Lesbian Mpeg Shannon M. Anderson (Apr 14)
• Videos Clips...SeXxXy jhaar (Apr 13)
• snort alerts backup agnelo d (Apr 13)
  • Re: snort alerts backup Guillaume Arcas (Apr 13)
• Unknown keyword ' flowbits' Haim Stotsky (Apr 14)
  • <Possible follow-ups>
  • RE: Unknown keyword ' flowbits' adam.w.hogan (Apr 14)
• block p2p traffic khaled fawzy (Apr 14)
  • Re: block p2p traffic Charles Lacroix (Apr 14)
• thresholding: How to get the sig_id? Maetzky (extern) (Apr 14)
  • Re: thresholding: How to get the sig_id? Dirk Geschke (Apr 14)
• Cannot recompile Snort after patching it! d . deboni (Apr 14)
• NETBIOS SMB winreg access (unicode) Perrymon, Josh L. (Apr 14)
  • <Possible follow-ups>
  • RE: NETBIOS SMB winreg access (unicode) Perrymon, Josh L. (Apr 14)
  • RE: NETBIOS SMB winreg access (unicode) larosa, vjay (Apr 14)
• Re: can Snort itself reconfigure a firewall Matt Kettler (Apr 14)
• Problem compiling MySQL Support into Snort Tony Howlett (Apr 14)
  • spp_portscan2 issues Marlon . Richards (Apr 15)
    • Re: spp_portscan2 issues Marlon . Richards (Apr 15)
      • Urls accessed Laura (Apr 15)
    • Message not available
      • Re: spp_portscan2 issues Matt Kettler (Apr 15)
  • <Possible follow-ups>
  • RE: Problem compiling MySQL Support into Snort Harper, Patrick (Apr 15)
    • RE: Problem compiling MySQL Support into Snort Tony Howlett (May 13)
      • Snort pass rules failing Jerry Shenk (May 13)
      • Re: Snort pass rules failing Matt Kettler (May 13)
      • RE: Snort pass rules failing Jerry Shenk (May 13)
      • RE: Snort pass rules failing Jerry Shenk (May 13)
  • RE: Problem compiling MySQL Support into Snort Fowler, Mike (Apr 19)
• rule help for a beginner [long sorry] eamonn doyle (Apr 14)
  • Re: rule help for a beginner [long sorry] Alejandro Flores (Apr 14)
• Movie jhaar (Apr 14)
• Todd Pratt is out until Friday the 16th Todd_Pratt (Apr 14)
• stream4: possible EVASIVE RST <-> EVASIVE RST Maetzky (extern) (Apr 15)
• snort rules updating on windows Romulo M. Cholewa (Apr 15)
  • <Possible follow-ups>
  • snort rules updating on windows Romulo M. Cholewa (Apr 15)
  • RE: snort rules updating on windows Romulo M. Cholewa (Apr 16)
• setting threshold for snort signatures agnelo d (Apr 15)
  • Re: setting threshold for snort signatures Guillaume Arcas (Apr 15)
  • Re: setting threshold for snort signatures Matt Kettler (Apr 15)
• snortcenter:problem of connection to snortcenter agent sanaâ Aitouchen (Apr 15)
• I am sure an easy answer Vojtech, John (Apr 15)
  • <Possible follow-ups>
  • RE: I am sure an easy answer Vojtech, John (Apr 15)
    • RE: I am sure an easy answer Michael Steele (Apr 15)
• Ethernet Tap Altrock, Jens (Apr 15)
  • Re: Ethernet Tap Matt Kettler (Apr 15)
  • Re: Ethernet Tap Sean Lazar (Apr 15)
  • <Possible follow-ups>
  • Re: Ethernet Tap Richard Bejtlich (Apr 16)
• thresholding: SMNP alerts Maetzky (extern) (Apr 15)
• Two easy questions dlimanov (Apr 15)
  • Re: Two easy questions Demetri Mouratis (Apr 15)
  • <Possible follow-ups>
  • Re: Two easy questions John Creegan (Apr 15)
• portscan2 output phani kumar (Apr 15)
• [OT] What happened to Erek? David (Apr 15)
  • Re: [OT] What happened to Erek? Matt Kettler (Apr 16)
• RE: Urls accessed Perrymon, Josh L. (Apr 15)
• file upload detection. Rajeev Kapoor (Apr 15)
• Snortcenter Running Snort ? HELP... Brian Webster (Apr 15)
• Much Better Screen Shots for WatchHog Randy Walinga (Apr 15)
• Snortcenter? Maetzky (extern) (Apr 16)
  • Re: Snortcenter? Keith W. McCammon (Apr 16)
    • RE: Snortcenter? Paul Martin (Apr 16)
      • Re: Snortcenter? Keith W. McCammon (Apr 16)
  • Re: Snortcenter? AJ Butcher, Information Systems and Computing (Apr 19)
• AW: Ethernet Tap Altrock, Jens (Apr 16)
  • Re: AW: Ethernet Tap Matt Kettler (Apr 16)
• Problem patching Snort d . deboni (Apr 16)
  • <Possible follow-ups>
  • Problem patching Snort d . deboni (Apr 16)
    • Re: Problem patching Snort Frank Knobbe (Apr 16)
      • Re: Problem patching Snort Antonio Eugenio Villar (Apr 16)
      • Re: Problem patching Snort Frank Knobbe (Apr 16)
• Content rule problem Antonio Eugenio Villar (Apr 16)
  • Re: Content rule problem Matt Kettler (Apr 16)
• Error In snort HELP!!! Cody R. Smith (Apr 16)
• Passive Ether Tap Matt Nelson (Apr 16)
  • <Possible follow-ups>
  • FW: Passive Ether Tap Matt Nelson (Apr 16)
• Various Alerts and Logging Bill Parker (Apr 16)
  • Re: Various Alerts and Logging Antonio Eugenio Villar (Apr 17)
• snort -c /etc/snort/snort.conf fatal error VanZee, Timothy (Apr 17)
  • Re: snort -c /etc/snort/snort.conf fatal error Patrick S. Harper (Apr 17)
  • <Possible follow-ups>
  • Re: snort -c /etc/snort/snort.conf fatal error nhdave (Apr 17)
  • RE: snort -c /etc/snort/snort.conf fatal error Harper, Patrick (Apr 21)
    • RE: snort -c /etc/snort/snort.conf fatal error Paul Schmehl (Apr 21)
• Logging Options w/o MySQL Kim Wall (Apr 18)
  • Re: Logging Options w/o MySQL Todd_Pratt (Apr 19)
• TCP packets detection problem ? Michal Kowalski (Apr 18)
  • Re: TCP packets detection problem ? Antonio Eugenio Villar (Apr 19)
  • Re: TCP packets detection problem ? Josh Berry (Apr 19)
• Low Snort performances Gianluca Murgia (Apr 19)
  • Re: Low Snort performances Edin Dizdarevic (Apr 19)
  • Re: Low Snort performances Chris Green (Apr 20)
  • <Possible follow-ups>
  • RE: Low Snort performances Bob Walder (Apr 19)
    • RE: Low Snort performances todb (Apr 19)
    • Re: Low Snort performances Nicholas Brawn (Apr 28)
  • RE: Low Snort performances Bob Walder (Apr 19)
    • RE: Low Snort performances todb (Apr 19)
  • RE: Low Snort performances Richard Bejtlich (Apr 19)
    • RE: Low Snort performances Zphosis De Extrodinaire (Apr 20)
  • RE: Low Snort performances SN ORT (Apr 19)
• Snorting on 2 interfaces Conan the Librarian (Apr 19)
  • Re: Snorting on 2 interfaces AJ Butcher, Information Systems and Computing (Apr 22)
  • <Possible follow-ups>
  • RE: Snorting on 2 interfaces Harper, Patrick (Apr 19)
  • RE: Snorting on 2 interfaces Truax, Shawn (MBS) (Apr 22)
• Create ACID AG Naveen C Joshi (Apr 19)
  • RE: Create ACID AG Michael Steele (Apr 19)
  • <Possible follow-ups>
  • RE: Create ACID AG Harper, Patrick (Apr 19)
    • RE: Create ACID AG Naveen C Joshi (Apr 19)
      • RE: Create ACID AG Naveen C Joshi (Apr 26)
      • Re: Create ACID AG Nick Oliver (Apr 26)
      • RE: Create ACID AG Naveen C Joshi (Apr 27)
      • RE: Create ACID AG Michael Steele (Apr 26)
      • RE: Create ACID AG Naveen C Joshi (Apr 27)
  • RE: Create ACID AG James Ashton (Apr 27)
  • RE: Create ACID AG Fowler, Mike (Apr 27)
    • RE: Create ACID AG Naveen C Joshi (Apr 28)
• Snortcenter jeep 94 (Apr 19)
  • RE: Snortcenter Eric Hines (Apr 19)
    • RE: Snortcenter AJ Butcher, Information Systems and Computing (Apr 20)
• Snot Newb Question Shaun Gray (Apr 19)
  • Re: Snot Newb Question Bryan Irvine (Apr 19)
  • <Possible follow-ups>
  • RE: Snot Newb Question Shaun Gray (Apr 19)
    • RE: Snot Newb Question Bryan Irvine (Apr 19)
      • RE: Snot Newb Question Bryan Irvine (Apr 19)
  • RE: Snot Newb Question Shaun Gray (Apr 19)
    • RE: Snot Newb Question Bryan Irvine (Apr 19)
    • RE: Snot Newb Question Mark Fagan (Apr 19)
  • RE: Snot Newb Question Harper, Patrick (Apr 19)
  • RE: Snot Newb Question Shaun Gray (Apr 19)
    • RE: Snot Newb Question Randy Walinga (Apr 19)
  • RE: Snot Newb Question Harper, Patrick (Apr 19)
  • RE: Snot Newb Question Harper, Patrick (Apr 19)
• help with mysql.php3 script problems ultan lankford (Apr 19)
  • <Possible follow-ups>
  • Re: help with mysql.php3 script problems ultan lankford (Apr 22)
• multiple NICs on OpenBSD 3.4 Jacob, Raymond A Jr (Apr 19)
• snort and snortsam snort teste (Apr 19)
  • Re: snort and snortsam Frank Knobbe (Apr 19)
  • <Possible follow-ups>
  • Snort and snortsam snort teste (Apr 20)
• Leasing snort system Mario Guerendo (Apr 19)
  • Re: Leasing snort system James Riden (Apr 19)
    • RE: Leasing snort system Keith Loyd (Apr 20)
  • <Possible follow-ups>
  • RE: Leasing snort system Jim Clews (Apr 20)
  • RE: Leasing snort system Harper, Patrick (Apr 20)
  • RE: Leasing snort system Corey Rock (Apr 21)
• openaanval calling home BM HM (Apr 19)
• Sneaky traffic WAS: RE: openaanval calling home Travis Wixel (Apr 19)
  • <Possible follow-ups>
  • RE: Sneaky traffic WAS: RE: openaanval calling home Travis Wixel (Apr 19)
• problem with acivate/dynamic rule: WARNING: an activation rule with no dynamic rules matched! Nicolas Dresse (Apr 20)
• Snort syslog + mysql + eventlog Romulo M. Cholewa (Apr 20)
• Not logging everything Chuck Holley (Apr 20)
  • RE: Not logging everything Fred Portnoy (Apr 20)
    • RE: Not logging everything Chuck Holley (Apr 20)
• new snortrules via ftp? Maetzky (extern) (Apr 20)
• RE: Snort Newb Question Cont.... Harper, Patrick (Apr 20)
• possible php problem dekid2 (Apr 20)
  • Re: possible php problem Bryan Irvine (Apr 20)
  • Re: possible php problem tslighter (Apr 20)
  • Re: possible php problem jon baer (Apr 20)
  • <Possible follow-ups>
  • Re: possible php problem dekid2 (Apr 20)
  • RE: possible php problem Harper, Patrick (Apr 20)
  • Re: possible php problem BM HM (Apr 20)
• snort.conf Chuck Holley (Apr 20)
  • Re: snort.conf Matt Kettler (Apr 20)
    • Re: snort.conf AJ Butcher, Information Systems and Computing (Apr 21)
      • Re: snort.conf James Riden (Apr 21)
• Re: possible php problem (fwd) dekid2 (Apr 20)
• snort_acid_rh9.pdf Maetzky (extern) (Apr 21)
  • Re: snort_acid_rh9.pdf Paul Schmehl (Apr 21)
  • <Possible follow-ups>
  • RE: snort_acid_rh9.pdf Harper, Patrick (Apr 21)
• Nimda 1287 rule Henderson Rachel (ITCS) s045 (Apr 21)
  • <Possible follow-ups>
  • RE: Nimda 1287 rule Donofrio, Lewis (Apr 21)
  • RE: Nimda 1287 rule Donofrio, Lewis (Apr 22)
• Snortsam log to database and correlation with snortdb Chan Kien Eng (Apr 21)
  • Re: Snortsam log to database and correlation with snortdb Frank Knobbe (Apr 21)
  • <Possible follow-ups>
  • RE: Snortsam log to database and correlation with snortdb Che Wan Zaharudin (Apr 22)
• contrib/snortpp.c? Maetzky (extern) (Apr 21)
• Problem IPSet dono levert (Apr 21)
• IPSet Problem dono levert (Apr 21)
  • Re: IPSet Problem Matt Kettler (Apr 21)
• Viewing packets logged to database WITHOUT alert Tuttle, Matthew D. (Apr 21)
  • <Possible follow-ups>
  • Viewing packets logged to database WITHOUT alert Tuttle, Matthew D. (Apr 27)
  • Viewing packets logged to database WITHOUT alert Tuttle, Matthew D. (Apr 27)
  • Viewing packets logged to database WITHOUT alert Tuttle, Matthew D. (Apr 27)
• emailing alerts Scott Skrogstad (Apr 21)
  • Re: emailing alerts Matt Kettler (Apr 21)
  • Re: emailing alerts Edin Dizdarevic (Apr 21)
  • AW: emailing alerts Freddie Soerensen (Apr 27)
  • <Possible follow-ups>
  • RE: emailing alerts Mike Koponick (Apr 21)
• Barnyard vs. Mudpit jonasb (Apr 21)
  • <Possible follow-ups>
  • RE: Barnyard vs. Mudpit Truax, Shawn (MBS) (Apr 22)
• AW: Snortsam log to database and correlation with snortdb Sean Wheeler (Apr 21)
• HTTP_PORTS Chuck Holley (Apr 21)
  • Re: HTTP_PORTS Matt Kettler (Apr 21)
    • RE: HTTP_PORTS Chuck Holley (Apr 21)
    • RE: HTTP_PORTS Chuck Holley (Apr 21)
• problems updating rules with oinkmaster Gus Fritschie (Apr 21)
  • Re: problems updating rules with oinkmaster Andreas Östling (Apr 21)
  • <Possible follow-ups>
  • RE: problems updating rules with oinkmaster Lancaster, J Jackson Contr SAF/FMPT (Apr 22)
  • RE: problems updating rules with oinkmaster Rowland, Krisa W ERDC-ITL-MS Contractor (Apr 22)
    • RE: problems updating rules with oinkmaster Andreas Östling (Apr 22)
    • RE: problems updating rules with oinkmaster Paul Schmehl (Apr 22)
  • Re: problems updating rules with oinkmaster Gus Fritschie (Apr 22)
    • Re: problems updating rules with oinkmaster Andreas Östling (Apr 22)
  • RE: problems updating rules with oinkmaster Rowland, Krisa W ERDC-ITL-MS Contractor (Apr 22)
  • RE: problems updating rules with oinkmaster Gus Fritschie (Apr 22)
    • RE: problems updating rules with oinkmaster Andreas Östling (Apr 22)
• Yet another alert not being logged to mysql database Jacob, Raymond A Jr (Apr 21)
• ERROR: Undefined variable name dlimanov (Apr 21)
  • <Possible follow-ups>
  • RE: ERROR: Undefined variable name Harper, Patrick (Apr 22)
• Yet another alert not being logged to mysql database[edited] Jacob, Raymond A Jr (Apr 21)
• Snort 2.1.3 RC1 available Jeremy Hewlett (Apr 21)
• Maximum Hardware Capacity for sensor Brian Webster (Apr 21)
• ids problems Jasmine CHUA (Apr 21)
  • Re: ids problems Guillaume Arcas (Apr 22)
  • <Possible follow-ups>
  • RE: ids problems Jasmine CHUA (Apr 22)
    • RE: ids problems Guillaume Arcas (Apr 22)
  • RE: ids problems Jasmine CHUA (Apr 22)
    • RE: ids problems Guillaume Arcas (Apr 22)
• Snort Service - Win2k Adv Server alagappan (Apr 21)
  • RE: Snort Service - Win2k Adv Server Michael Steele (Apr 22)
• Snort as IPS Nicolas Saurbier (Apr 22)
  • Re: Snort as IPS Guillaume Arcas (Apr 22)
  • <Possible follow-ups>
  • RE: Snort as IPS Che Wan Zaharudin (Apr 22)
• IDS problems -> part two (unresolved) Jasmine CHUA (Apr 22)
• a lot of Loopback traffic being logged. Chuck Holley (Apr 22)
  • Re: a lot of Loopback traffic being logged. Matt Kettler (Apr 22)
    • RE: a lot of Loopback traffic being logged. Chuck Holley (Apr 22)
      • RE: a lot of Loopback traffic being logged. Matt Kettler (Apr 22)
      • RE: a lot of Loopback traffic being logged. Harry Bloomberg (Apr 22)
      • RE: a lot of Loopback traffic being logged. Fred Portnoy (Apr 22)
    • Need configuration help Tinni (Apr 22)
      • How to start snort for multiple servers' traffic Tinni (Apr 23)
      • Re: How to start snort for multiple servers' traffic Edin Dizdarevic (Apr 23)
  • <Possible follow-ups>
  • Re: a lot of Loopback traffic being logged. Mark . Schutzmann (Apr 22)
    • RE: a lot of Loopback traffic being logged. Chuck Holley (Apr 23)
      • RE: a lot of Loopback traffic being logged. Fred Portnoy (Apr 23)
      • RE: a lot of Loopback traffic being logged. Chuck Holley (Apr 23)
      • RE: a lot of Loopback traffic being logged. Fred Portnoy (Apr 23)
      • RE: a lot of Loopback traffic being logged. Milan Kocián (Apr 25)
  • RE: a lot of Loopback traffic being logged. Mark . Schutzmann (Apr 23)
  • RE: a lot of Loopback traffic being logged. rod (May 27)
    • RE: a lot of Loopback traffic being logged. Alejandro Flores (May 27)
      • RE: a lot of Loopback traffic being logged. rod (May 28)
    • how to clean up database? Cesar (May 27)
• snort daemon not getting Tinni (Apr 22)
  • <Possible follow-ups>
  • RE: snort daemon not getting Harper, Patrick (Apr 22)
• Password characters that snort does not like Harper, Patrick (Apr 22)
  • Running Snort in Sniffer mode Marlon . Richards (Apr 22)
    • Message not available
      • Re: Running Snort in Sniffer mode Matt Kettler (Apr 22)
  • Message not available
    • Re: Password characters that snort does not like Matt Kettler (Apr 22)
• I've read FAQ; Need switch/hub advice. Shaun T. Erickson (Apr 22)
• OpenBSD 3.4 snort--X-->mysql not working and I don't see any errors on startup Jacob, Raymond A Jr (Apr 22)
• doubts about how many false positives exists Ernesto (Apr 22)
  • Re: doubts about how many false positives exists Matt Kettler (Apr 22)
• Oinkmaster Problem Line 791 Josh Berry (Apr 22)
  • Re: Oinkmaster Problem Line 791 Andreas Östling (Apr 22)
• Yup it's the hardware question... (again) Brian Webster (Apr 22)
• Re: NetSky worm signature definition...!!! Matt Linton (Apr 22)
• No logs are being generated Tinni (Apr 22)
  • <Possible follow-ups>
  • No logs are being generated Tinni (Apr 22)
• Ossim Framework Altrock, Jens (Apr 23)
  • Re: Ossim Framework AJ Butcher, Information Systems and Computing (Apr 23)
• virus-tracing with snort? Maetzky (extern) (Apr 23)
• Oinkmaster woops Rowland, Krisa W ERDC-ITL-MS Contractor (Apr 23)
  • Re: Oinkmaster woops Andreas Östling (Apr 23)
• Rules for non existent IPs Marc Cozzi (Apr 23)
  • Re: Rules for non existent IPs Frank Knobbe (Apr 23)
  • <Possible follow-ups>
  • RE: Rules for non existent IPs Frank Knobbe (Apr 23)
• Loopback traffic Rodrigo B. Ramos (Apr 23)
  • RE: Loopback traffic Chuck Holley (Apr 23)
    • RE: Loopback traffic Matt Kettler (Apr 26)
  • <Possible follow-ups>
  • loopback traffic Security Personnel (May 19)
    • Re: loopback traffic Matt Kettler (May 19)
      • Re: loopback traffic James Riden (May 19)
    • Re: loopback traffic Security Personnel (May 19)
  • RE: loopback traffic Bob Sukovich (May 20)
• FW: (reality check)Solved(i think):OpenBSD 3.4 snort--X-->mysql alerts now being generated Jacob, Raymond A Jr (Apr 23)
• Getting more paranoid by the minute. :-/ Shaun T. Erickson (Apr 24)
  • Re: Getting more paranoid by the minute. :-/ Paul Schmehl (Apr 24)
    • Re: Getting more paranoid by the minute. :-/ Chris Burton (Apr 24)
      • Re: Getting more paranoid by the minute. :-/ Shaun T. Erickson (Apr 24)
    • Re: Getting more paranoid by the minute. :-/ Shaun T. Erickson (Apr 24)
    • Re: Getting more paranoid by the minute. :-/ Shaun T. Erickson (Apr 24)
      • Re: Getting more paranoid by the minute. :-/ Demetri Mouratis (Apr 24)
      • Re: Getting more paranoid by the minute. :-/ Shaun T. Erickson (Apr 24)
      • Re: Getting more paranoid by the minute. :-/ Alejandro Flores (Apr 25)
  • RE: Getting more paranoid by the minute. :-/ Jim Hendrick (Apr 25)
  • Re: Getting more paranoid by the minute. :-/ AJ Butcher, Information Systems and Computing (Apr 26)
  • Re: Getting more paranoid by the minute. :-/ Andreas (Apr 26)
    • Re: Getting more paranoid by the minute. :-/ Shaun T. Erickson (Apr 26)
  • <Possible follow-ups>
  • RE: Getting more paranoid by the minute. :-/ Romulo M. Cholewa (Apr 24)
    • Re: Getting more paranoid by the minute. :-/ Shaun T. Erickson (Apr 24)
  • RE: Getting more paranoid by the minute. :-/ Donofrio, Lewis (Apr 26)
  • Re: Getting more paranoid by the minute. :-/ Corey Rock (Apr 29)
• Snort is not responding to the other hosts in the same network Tinni (Apr 25)
  • Re: Snort is not responding to the other hosts in the same network Demetri Mouratis (Apr 25)
• Running Libnet 1.0.x and 1.1.x on the same machine... Nicolas Saurbier (Apr 26)
• Problems with snort Adriano Bandeira de Araújo (Apr 26)
  • Re: Problems with snort Alejandro Flores (Apr 26)
  • <Possible follow-ups>
  • RE: Problems with snort Harper, Patrick (Apr 26)
• Signature Database Lancaster, J Jackson Contr SAF/FMPT (Apr 26)
• Snort for WIndows newbie question... Ambrose, Joseph (Apr 26)
  • Message not available
    • Re: Snort for WIndows newbie question... Matt Kettler (Apr 26)
  • <Possible follow-ups>
  • RE: Snort for WIndows newbie question... Ambrose, Joseph (Apr 26)
  • RE: Snort for WIndows newbie question... Ambrose, Joseph (Apr 28)
    • RE: Snort for WIndows newbie question... Michael Steele (Apr 28)
      • RE: Snort for WIndows newbie question... Matt Kettler (Apr 28)
  • RE: Snort for WIndows newbie question... Romulo M. Cholewa (Apr 28)
• MS SQL 2000 database setup for snort with snortdb-extra (osql syntax issues?) McCash, John (Apr 26)
  • <Possible follow-ups>
  • MS SQL 2000 database setup for snort with snortdb-extra (osql syntax issues?) McCash, John (Apr 27)
    • Re: MS SQL 2000 database setup for snort with snortdb-extra (osql syntax issues?) Tony Ly (Apr 27)
    • Re: MS SQL 2000 database setup for snort with snortdb-extra (osql syntax issues?) todb (Apr 27)
• Fatal Error, Quitting.. dlimanov (Apr 26)
  • RE: Fatal Error, Quitting.. Paul Martin (Apr 26)
  • Re: Fatal Error, Quitting.. James Riden (Apr 26)
  • <Possible follow-ups>
  • RE: Fatal Error, Quitting.. Harper, Patrick (Apr 26)
    • RE: Fatal Error, Quitting.. dlimanov (Apr 26)
  • RE: Fatal Error, Quitting.. Bob Walder (Apr 27)
• Error compiling Snort 2.1.3 RC1 Gary_Portnoy (Apr 26)
• perfmonitor Maetzky (extern) (Apr 27)
• snortcenter server soula soumi (Apr 27)
• Snort/Linux Dropping Packets snort user (Apr 27)
• slackware how-to osama (Apr 27)
  • Re: slackware how-to Michael Sconzo (Apr 27)
• Snort newbie Chris Strzelczyk (Apr 27)
• Content across multiple packets Not detected by Snort Dennis George (Apr 27)
• Traffic Generator / Host Emulator Josh Gomez (Apr 27)
• Which version started support for PCRE? Stef (Apr 27)
  • Re: Which version started support for PCRE? Stef (Apr 27)
• Snort to detect Window worms & scanners etc. Jorgen Lundman (Apr 27)
• Snort Logging to SQL Server 2000? McCash, John (Apr 27)
• Log analysis without ACID Frank Barton (Apr 27)
  • RE: Log analysis without ACID Michael Steele (Apr 27)
    • Re: Log analysis without ACID Michael Sconzo (Apr 27)
  • <Possible follow-ups>
  • Re: Log analysis without ACID Frank Barton (Apr 29)
    • RE: Re: Log analysis without ACID Randy Walinga (Apr 29)
  • RE: Re: Log analysis without ACID Kreimendahl, Chad J (Apr 29)
  • Re: Log analysis without ACID BM HM (May 03)
• Snort start up on Multiple interface Brian Webster (Apr 27)
  • Message not available
    • Re: Snort start up on Multiple interface Matt Kettler (Apr 27)
      • Re: Snort start up on Multiple interface Daniel Wittenberg (Apr 27)
      • Re: Snort start up on Multiple interface Edin Dizdarevic (Apr 28)
      • Re: Snort start up on Multiple interface Matt Kettler (Apr 28)
      • Re: Snort start up on Multiple interface Edin Dizdarevic (Apr 28)
      • Re: Snort start up on Multiple interface Matt Kettler (Apr 28)
      • Re: Snort start up on Multiple interface Edin Dizdarevic (Apr 28)
      • Re: Snort start up on Multiple interface Milo Velimirovic (Apr 29)
  • <Possible follow-ups>
  • RE: Snort start up on Multiple interface Truax, Shawn (MBS) (Apr 27)
• RE: MS SQL 2000 database setup for snort with snortdb-extra (osql syntax issues?) McCash, John (Apr 27)
• where can I find info about rules? Marcin Laskowski (Apr 27)
  • Re: where can I find info about rules? Matt Kettler (Apr 27)
• Snort re-setup issues Greg Webster (Apr 27)
  • <Possible follow-ups>
  • RE: Snort re-setup issues Truax, Shawn (MBS) (Apr 27)
    • RE: Snort re-setup issues Greg Webster (Apr 29)
• database output plugin sensor_name parameter and ACID strangeness Muntner, Adam (Apr 27)
  • <Possible follow-ups>
  • RE: database output plugin sensor_name parameter and ACID strangeness Che Wan Zaharudin (Apr 27)
• snort >= 2.1.2 on OpenBSD -current and memory limits Jon Hart (Apr 27)
  • Re: snort >= 2.1.2 on OpenBSD -current and memory limits Jon Hart (Apr 30)
    • Re: snort >= 2.1.2 on OpenBSD -current and memory limits Jon Hart (May 10)
• Cisco 6500 SPAN limitations, dropping packets, VACLs, RSPAN, real world Jack McDonough (Apr 27)
  • Re: Cisco 6500 SPAN limitations, dropping packets, VACLs, RSPAN, real world twig les (Apr 28)
• 2.1.3RC1 event_queue and custom ruletypes/log rules? Erik Fichtner (Apr 27)
  • Re: 2.1.3RC1 event_queue and custom ruletypes/log rules? Jeremy Hewlett (May 03)
    • Re: 2.1.3RC1 event_queue and custom ruletypes/log rules? Bamm Visscher (May 03)
• IDS and Firewall Kernel The Canine (Apr 28)
  • Re: IDS and Firewall Ravi (Apr 28)
  • Re: IDS and Firewall Marcin Laskowski (Apr 28)
    • Re: IDS and Firewall Alejandro Flores (Apr 28)
      • Re: IDS and Firewall Kernel The Canine (Apr 28)
      • Re: IDS and Firewall Matt Kettler (Apr 28)
  • RE: IDS and Firewall Jim Hendrick (Apr 28)
  • Re: IDS and Firewall Matt Kettler (Apr 28)
  • <Possible follow-ups>
  • RE: IDS and Firewall Shaffer, Paul D (Apr 28)
    • Re: IDS and Firewall James Riden (Apr 28)
  • RE: IDS and Firewall Shaffer, Paul D (Apr 29)
    • Message not available
      • RE: IDS and Firewall Matt Kettler (Apr 29)
      • Snort Rule Downloading - No Updates Since 4/15? Snortty (Apr 30)
• Error compiling Snort Gary_Portnoy (Apr 28)
  • Re: Error compiling Snort George Theall (Apr 28)
    • VPNs and TCP Matt Linton (Apr 28)
  • <Possible follow-ups>
  • Re: Error compiling Snort Gary_Portnoy (Apr 30)
• portscan question Darryl Cook (Apr 28)
  • Re: portscan question Darryl Cook (Apr 28)
    • Re: portscan question Matt Kettler (Apr 28)
• Question on stream4 preprocessor sgt_b (Apr 28)
  • <Possible follow-ups>
  • Re: Question on stream4 preprocessor sgt_b (May 03)
• Setup help requested Bodo Gabor (Apr 28)
  • RE: Setup help requested Jim Hendrick (Apr 28)
• rules Macaluso Aldo (Apr 28)
  • Re: rules Matt Kettler (Apr 28)
  • Re: rules Alejandro Flores (Apr 28)
• snort dropping 48% ?? Sheahan, Paul (Apr 28)
• snort dropping 48% Sheahan, Paul (Apr 28)
  • Message not available
    • Re: snort dropping 48% Matt Kettler (Apr 28)
      • legit network-traffic generating tool? siddharth thakkar (Apr 28)
  • <Possible follow-ups>
  • RE: snort dropping 48% Sheahan, Paul (May 06)
    • Re: snort dropping 48% sgt_b (May 06)
  • RE: snort dropping 48% Sheahan, Paul (May 06)
    • Re: snort dropping 48% sgt_b (May 06)
  • RE: snort dropping 48% Sheahan, Paul (May 06)
    • RE: snort dropping 48% Frank Knobbe (May 06)
    • Re: snort dropping 48% sgt_b (May 06)
      • Re: snort dropping 48% Josh Berry (May 07)
      • RE: snort dropping 48% Chuck Holley (May 07)
      • RE: snort dropping 48% Michael Boman (May 10)
      • Message not available
      • RE: snort dropping 48% Josh Berry (May 07)
    • RE: snort dropping 48% Josh Berry (May 07)
  • RE: snort dropping 48% SN ORT (May 06)
  • RE: snort dropping 48% Lyons, Jon (May 06)
  • RE: snort dropping 48% Sheahan, Paul (May 07)
    • RE: snort dropping 48% Josh Berry (May 07)
  • RE: snort dropping 48% larosa, vjay (May 07)
  • RE: snort dropping 48% larosa, vjay (May 07)
  • RE: snort dropping 48% Sheahan, Paul (May 07)
    • RE: snort dropping 48% Josh Berry (May 07)
  • RE: snort dropping 48% Sheahan, Paul (May 07)
  • RE: snort dropping 48% Sheahan, Paul (May 07)
  • RE: snort dropping 48% larosa, vjay (May 07)
  • RE: snort dropping 48% Jon Lyons (May 10)
  • RE: snort dropping 48% Kreimendahl, Chad J (May 11)
• test - please disregard Sheahan, Paul (Apr 28)
• sguil-0.4.0 Released Bamm Visscher (Apr 28)
• Output log_null and -N don't work Sheahan, Paul (Apr 28)
• Are there known bugs in the odbc output plugin WRT FreeTDS and unixODBC? McCash, John (Apr 28)
  • RE: Are there known bugs in the odbc output plugin WRT FreeTDS and unixODBC? Keith Loyd (Apr 28)
  • <Possible follow-ups>
  • RE: Are there known bugs in the odbc output plugin WRT FreeTDS and unixODBC? McCash, John (Apr 30)
• Are there known bugs in the odbc output plugin WRT FreeTDS and unixODBC? (more debug info) McCash, John (Apr 28)
  • RE: Are there known bugs in the odbc output plugin WRT FreeTDS and unixODBC? (more debug info) Keith Loyd (Apr 28)
  • <Possible follow-ups>
  • RE: Are there known bugs in the odbc output plugin WRT FreeTDS and unixODBC? (more debug info) McCash, John (Apr 29)
  • RE: Are there known bugs in the odbc output plugin WRT FreeTDS and unixODBC? (more debug info) McCash, John (Apr 29)
• Compilation problem Ramesh Pillai (Apr 29)
  • Re: Compilation problem siddharth thakkar (Apr 29)
  • <Possible follow-ups>
  • Re: Compilation problem Ramesh Pillai (Apr 29)
• Snort on Suse Linux - snortd paths Neil Wellard (Apr 29)
  • <Possible follow-ups>
  • Re: Snort on Suse Linux - snortd paths Manuel Balderrábano (May 03)
• Database not suported after compillation, pls HELP Bodo Gabor (Apr 29)
• TCP Session logging with ACID jonasb (Apr 29)
  • Re: TCP Session logging with ACID AJ Butcher, Information Systems and Computing (Apr 30)
• Problems with jpgraph and ACID ... Michael Chapman (Apr 29)
  • Re: Problems with jpgraph and ACID ... AJ Butcher, Information Systems and Computing (Apr 30)
    • Re: Problems with jpgraph and ACID ... Matthias Güntert (Apr 30)
  • <Possible follow-ups>
  • RE: Problems with jpgraph and ACID ... Michael Chapman (Apr 30)
• Content string search across packets sowdambiga karthikeyan (Apr 29)
  • Re: Content string search across packets Matt Kettler (Apr 29)
• Multiple sensors on 1 box? Travis Wixel (Apr 29)
• Error while starting snort François Delaby (Apr 30)
  • Re: Error while starting snort Matt Kettler (Apr 30)
    • Re: Error while starting snort François Delaby (Apr 30)
      • Re: Error while starting snort Nerijus Krukauskas (May 03)
      • Re: Error while starting snort François Delaby (May 03)
• RE: Snort Rule Downloading - No Updates Since 4/15? Rowland, Krisa W ERDC-ITL-MS Contractor (Apr 30)
  • <Possible follow-ups>
  • RE: Snort Rule Downloading - No Updates Since 4/15? Gus Fritschie (Apr 30)
    • RE: Snort Rule Downloading - No Updates Since 4/15? Snortty (Apr 30)
  • RE: Snort Rule Downloading - No Updates Since 4/15? M. Morgan (May 03)
  • RE: Snort Rule Downloading - No Updates Since 4/15? Rowland, Krisa W ERDC-ITL-MS Contractor (May 03)
    • RE: Snort Rule Downloading - Working now! Snortty (May 03)
      • Logically truncated snortrules-snapshot tarball [was: Re: Snort Rule Downloading] Kristofer T. Karas (May 03)
      • Re: Logically truncated snortrules-snapshot tarball [was: Re: Snort Rule Downloading] Brian (May 04)
• [OpenBSD 3.4 + snort 2.0.0b72] Strange Bad Traffic alert generating from 127.0.0.1:80 to the firewall's external ip Calyth (May 01)
  • <Possible follow-ups>
  • RE: [OpenBSD 3.4 + snort 2.0.0b72] Strange Bad Traffic alert generating from 127.0.0.1:80 to the firewall's external ip Corey Rock (May 01)
    • Re: [OpenBSD 3.4 + snort 2.0.0b72] Strange Bad Traffic alert generating from 127.0.0.1:80 to the firewall's external ip Calyth (May 02)
• Barnyard 0.2.0 available Andrew R. Baker (May 01)
• logging directory "/var/log/snort" Corey Rock (May 01)
  • Re: logging directory "/var/log/snort" sgt_b (May 01)
  • Re: logging directory "/var/log/snort" sgt_b (May 01)
  • <Possible follow-ups>
  • Re: logging directory "/var/log/snort" Corey Rock (May 01)
  • Re: logging directory "/var/log/snort" Corey Rock (May 01)
• Sasser.b Worm Signature and Information Mark . Schutzmann (May 01)
  • <Possible follow-ups>
  • RE: Sasser.b Worm Signature and Information larosa, vjay (May 02)
  • RE: Sasser.b Worm Signature and Information larosa, vjay (May 02)
• [OBSD 3.4 and Snort 2.0.0b72] snort does not handle kill -hup well when user/group param specified Calyth (May 03)
• SNORT Analyzer with PHP and MySQL M. Salman Farisi (May 03)
• Re: Snort-users digest, Vol 1 #4200 - 4 msgs attechni (May 03)
• Problem to configure IDS with snort-wireless Piergiorgio Venuti (May 03)
• SnortSNMP : [was Re: [Snort-announce] Snort 2.1.3 RC1 available:] Glenn Mansfield Keeni (May 03)
• sensor on ACID console Naveen C Joshi (May 03)
• Increase in nmap pings Michael Schwartzkopff (May 03)
  • <Possible follow-ups>
  • RE: Increase in nmap pings Miner, Jonathan W (May 03)
    • RE: Increase in nmap pings Chuck Holley (May 03)
      • RE: Increase in nmap pings Frank Knobbe (May 03)
  • RE: Increase in nmap pings Miner, Jonathan W (May 03)
  • RE: Increase in nmap pings Larry Pitcher (May 03)
    • Re: Increase in nmap pings Michael Schwartzkopff (May 03)
• newbie ? about tcp packet collection for specific ip Janet Norton (May 03)
  • Re: newbie ? about tcp packet collection for specific ip sgt_b (May 03)
  • <Possible follow-ups>
  • newbie ? about tcp packet collection for specific ip Janet Norton (May 10)
• MS SQL database information Gargac. Jeff (May 03)
  • Re: MS SQL database information Tony Carter (May 03)
  • RE: MS SQL database information Jeff Dell (May 03)
• RE: Snort Rule Downloading - Working now! (NOT!!!) McCash, John (May 03)
• -N option doesn't work Sheahan, Paul (May 03)
• ICMP echo rules Mario Guerendo (May 03)
• ICMP echo packets Mario Guerendo (May 03)
• Snort Users Group, DC - Q2 Meeting Planning Keith W. McCammon (May 04)
• Need help with snort output to bash script. Thomas Lauret (May 04)
  • Re: Need help with snort output to bash script. Matt Kettler (May 05)
• RE: Snort Rule Downloading - Working now! (NOT!!!) (update use -CURRENT for 2.1.2) McCash, John (May 04)
  • <Possible follow-ups>
  • RE: Snort Rule Downloading - Working now! (NOT!!!) (update use -CURRENT for 2.1.2) Vogle, Brian (May 04)
    • Re: Snort Rule Downloading - Working now! (NOT!!!) (update use -CURRENT for 2.1.2) Jason (May 04)
  • RE: Snort Rule Downloading - Working now! (NOT!!!) (update use -CURRENT for 2.1.2) McCash, John (May 04)
    • RE: Snort Rule Downloading - Working now! (NOT!!!) (update use -CURRENT for 2.1.2) Frank Knobbe (May 04)
  • Re: Snort Rule Downloading - Working now! (NOT!!!) (update use -CURRENT for 2.1.2) M. Morgan (May 05)
• Internet Update in snortcenter John Hally (May 04)
  • <Possible follow-ups>
  • Re: Internet Update in snortcenter jonasb (May 04)
  • RE: Internet Update in snortcenter Truax, Shawn (MBS) (May 06)
• Typical barnyard compile problems Mike Cohen (May 04)
  • Barnyard & SnortAlog Cédric BLIN (May 05)
  • Re: Typical barnyard compile problems Bamm Visscher (May 05)
    • Typical barnyard compile problems (mysql error) Thomas Bechtold (May 10)
      • Re: [Barnyard-users] Typical barnyard compile problems (mysql error) Andreas (May 05)
  • <Possible follow-ups>
  • RE: Typical barnyard compile problems Michael Shirk (May 05)
  • RE: Typical barnyard compile problems Mike Cohen (May 10)
  • Re: Typical barnyard compile problems Richard Bejtlich (May 13)
• snort log files Michael Banta (May 04)
  • Re: snort log files Ravi (May 04)
• email alert configuration Rajesh (May 04)
  • Re: email alert configuration Ravi (May 04)
  • <Possible follow-ups>
  • Re: email alert configuration Rajesh (May 04)
    • Re: email alert configuration Edin Dizdarevic (May 05)
• AW: Typical barnyard compile problems Povel, Michael (May 05)
• Unified Alert logs and portscan alarms Povel, Michael (May 05)
• output log format Janet Norton (May 05)
• Hi everyone ! Zhaofu (May 05)
• normal vs. malicious icmp echo Mario Guerendo (May 05)
  • Re: normal vs. malicious icmp echo Erik Fichtner (May 05)
  • Re: normal vs. malicious icmp echo Matt Kettler (May 06)
    • Re: normal vs. malicious icmp echo Milo Velimirovic (May 06)
• AW: Barnyard & SnortAlog Povel, Michael (May 06)
  • <Possible follow-ups>
  • AW: Barnyard & SnortAlog Povel, Michael (May 06)
• Log file owned by root problem bitless (May 06)
  • Re: Log file owned by root problem sgt_b (May 06)
  • Re: Log file owned by root problem Matt Kettler (May 06)
  • Re: Log file owned by root problem Bamm Visscher (May 06)
  • <Possible follow-ups>
  • Log file owned by root problem bitless (May 10)
  • RE: Log file owned by root problem SRH-Lists (May 10)
• Snort and Barnyard question about syslog output. Timothy W Morrison (May 06)
  • Re: Snort and Barnyard question about syslog output. Bamm Visscher (May 06)
• Problem detecting MS-SQL sa login failures? Anton Christian (May 06)
  • Re: Problem detecting MS-SQL sa login failures? Brian (May 06)
• RE: Snort-users digest, Vol 1 #4212 - 5 msgs Jason Biggin (May 07)
• Snort-Hardware integration ac107029 (May 07)
• max_queue_events Thomas Bechtold (May 07)
  • RE: [Snort-devel] max_queue_events Marc Norton (May 10)
  • <Possible follow-ups>
  • max_queue_events Thomas Bechtold (May 10)
• IDS alert Naveen C Joshi (May 08)
  • Re: IDS alert Ravi (May 08)
  • <Possible follow-ups>
  • Re: IDS alert Michael Shirk (May 10)
• Is there such a thing as a morning after IDS? Jacob, Raymond A Jr (May 08)
  • Re: Is there such a thing as a morning after IDS? Nicholas W. Oliver (May 08)
  • <Possible follow-ups>
  • RE: Is there such a thing as a morning after IDS? Hutchinson, Andrew (May 08)
  • Re: Is there such a thing as a morning after IDS? M. Morgan (May 10)
• Question about 'logto' and 'log_tcpdump' Lin Zhong (May 08)
• SNMP bassem tannous (May 09)
  • Re: SNMP Glenn Mansfield Keeni (Jun 18)
  • <Possible follow-ups>
  • RE: SNMP Harper, Patrick (May 10)
• Newbie - Rules updates, multiple interfaces, etc. Mark G. Spencer (May 09)
  • <Possible follow-ups>
  • Re: Newbie - Rules updates, multiple interfaces, etc. Richard Bejtlich (May 10)
• Confused about rules and logs b311b-snort (May 09)
  • <Possible follow-ups>
  • Re: Confused about rules and logs Richard Bejtlich (May 10)
    • Re: Re: Confused about rules and logs b311b-snort (May 10)
  • Re: Confused about rules and logs Richard Bejtlich (May 10)
• Re: same problem as you Snortty (May 10)
  • Re: Re: same problem as you Dirk Geschke (May 10)
    • Re: snort 2.1.1 on Solaris 8 is WORKING now. Snortty (May 11)
      • Re: snort 2.1.1 on Solaris 8 is WORKING now. Marcus (May 11)
      • Re: snort 2.1.1 on Solaris 8 is WORKING now. Cedric Guillotin (May 12)
      • Re: snort 2.1.1 on Solaris 8 is WORKING now. Alain Defrance (May 12)
• where can i find info about events derk van de Velde (May 10)
  • Re: where can i find info about events Matt Kettler (May 10)
• logfile problem Dino (May 10)
• RUXCON Final Call For Papers RUXCON Staff (May 10)
• Typical barnyard compile problems (Povel, Michael) Mike Cohen (May 10)
  • Re: Typical barnyard compile problems (Povel, Michael) Thomas Bechtold (May 10)
    • Re: Typical barnyard compile problems Olaf Schreck (May 11)
• about some error ajay sahasrabudhe (May 10)
  • <Possible follow-ups>
  • RE: about some error Harper, Patrick (May 10)
    • RE: about some error ajay sahasrabudhe (May 12)
      • RE: about some error Michael Steele (May 12)
• How do I convert a snort source IP Number to IP address in Microsoft SQL Server Joe Stocker (May 10)
  • Re: How do I convert a snort source IP Number to IP address in Microsoft SQL Server AJ Butcher, Information Systems and Computing (May 10)
    • Re: How do I convert a snort source IP Number to IP address in Microsoft SQL Server b311b-snort (May 10)
  • <Possible follow-ups>
  • Re: How do I convert a snort source IP Number to IP address in Microsoft SQL Server AJ Butcher, Information Systems and Computing (May 11)
• Fw: stream4 preprocessor and resetting the stream due to alert William Metcalf (May 10)
• Snort sensor and mysql setup Lance Boon (May 10)
  • <Possible follow-ups>
  • RE: Snort sensor and mysql setup Harper, Patrick (May 10)
• Snort and reserved words PATENAUDE, PATRICK (May 10)
  • Re: Snort and reserved words Matt Kettler (May 10)
• different logging options. Timothy W Morrison (May 10)
  • Re: different logging options. Jason Monroe "JC" (May 10)
  • RE: different logging options. -- Applied Watch Eric Hines (May 13)
    • Re: different logging options. -- Applied Watch Brian (May 13)
      • RE: different logging options. -- Applied Watch Eric Hines (May 13)
      • Re: different logging options. -- Applied Watch Brian (May 13)
• IMAP Auth Literal Overflow Sonika Malhotra (May 11)
• New Sasser Worm Signatures Alan (May 11)
  • <Possible follow-ups>
  • RE: New Sasser Worm Signatures Sheahan, Paul (May 11)
  • Re: RE: New Sasser Worm Signatures ids (May 11)
  • Re: RE: Re: New Sasser Worm Signatures ids (May 11)
• snort http_inspect nyarlathothep () libero it (May 11)
  • Re: snort http_inspect sgt_b (May 11)
  • Re: snort http_inspect Jeremy Hewlett (May 11)
    • Re: snort http_inspect alerts still flooding on snort 2.1.2.... Snortty (May 21)
• Flow-portscan Jochen Vogel (May 11)
• oops... the conf file nyarlathothep () libero it (May 11)
• http_inspect : It nyarlathothep () libero it (May 11)
• Rule not working simonkc (May 11)
• Malware Rules Updated Darden, Patrick S. (May 11)
  • Applied Watch sherri.harper (May 13)
    • Re: Applied Watch Frank Knobbe (May 13)
      • RE: Applied Watch sherri.harper (May 13)
      • Administrativia: No advertising please Andrew R. Baker (May 13)
      • Re: Administrativia: No advertising please James Riden (May 13)
      • RE: Administrativia: No advertising please Michael Steele (May 13)
      • Re: Administrativia: No advertising please Shaun T. Erickson (May 13)
      • Re: Administrativia: No advertising please James Riden (May 13)
    • Re: Applied Watch Jason (May 13)
• [snort-users] Blocking with a PIX d . deboni (May 11)
  • <Possible follow-ups>
  • RE: [snort-users] Blocking with a PIX Hutchinson, Andrew (May 11)
  • RE: [snort-users] Blocking with a PIX d . deboni (May 11)
  • RE: [snort-users] Blocking with a PIX d . deboni (May 11)
• first post to this maillist steph march (May 11)
  • Re: first post to this maillist Matt Kettler (May 11)
    • Re: first post to this maillist Nick Oliver (May 11)
• RE: [snortsam-discussion] Blocking with a PIX d . deboni (May 11)
• Snort speed limit? Sheahan, Paul (May 11)
  • Message not available
    • Re: Snort speed limit? Matt Kettler (May 11)
• Multiple output plugins Gary_Portnoy (May 11)
• Re: ANOMALOUS HTTP SERVER ON UNDEFINED HTTP PORT Brian (May 11)
• snort on a worksation (fc1) <-- router <-- cable-modem <-- internet steph march (May 11)
  • Re: snort on a worksation (fc1) <-- router <-- cable-modem <-- internet Matt Kettler (May 11)
• P2P Gnutella Signature does a more precise or final version of the signature exist? Jacob, Raymond A Jr (May 11)
• Stupid Question Bell, Josh (May 11)
  • <Possible follow-ups>
  • RE: Stupid Question larosa, vjay (May 11)
    • RE: Stupid Question AJ Butcher, Information Systems and Computing (May 12)
• No alert detection on alert console Naveen C Joshi (May 12)
  • <Possible follow-ups>
  • RE: No alert detection on alert console Truax, Shawn (MBS) (May 12)
• [snort-users] Bad Performance d . deboni (May 12)
  • RE: [snort-users] Bad Performance Jim Hendrick (May 12)
• Reppeated warnings Manuel Balderrábano (May 12)
• Strange packet phasma (May 12)
  • Re: Strange packet todb (May 12)
• wireless patch wireless (May 12)
  • Re: wireless patch Steffen Pfendtner (May 14)
• Snort but no alert nyarlathothep () libero it (May 12)
  • RE: Snort but no alert Michael Steele (May 12)
  • <Possible follow-ups>
  • RE: Snort but no alert Nick Duda (May 12)
  • RE: Snort but no alert nyarlathothep () libero it (May 13)
  • RE: Snort but no alert nyarlathothep () libero it (May 17)
• new Barnyard new snortb Chuck Holley (May 12)
  • Re: new Barnyard new snortb Michael Anderson (May 12)
    • snort and firewall all in one machine Peggy Kam (May 13)
      • Re: snort and firewall all in one machine Matt Kettler (May 13)
  • <Possible follow-ups>
  • Re: new Barnyard new snortb Michael Anderson (May 12)
    • RE: new Barnyard new snortb Chuck Holley (May 13)
      • Re: new Barnyard new snortb Bamm Visscher (May 13)
      • RE: new Barnyard new snortb Chuck Holley (May 14)
  • Re: new Barnyard new snortb Michael Anderson (May 14)
• RE: Snort-users digest, Vol 1 #4222 - 9 msgs Danista R. Lata (May 12)
• Barnyard issues Gary_Portnoy (May 12)
  • <Possible follow-ups>
  • barnyard issues David (Jun 01)
  • RE: barnyard issues SRH-Lists (Jun 01)
• How to reference a $var in pcre? Kirk Vogelsang (May 12)
  • Re: How to reference a $var in pcre? Matt Kettler (May 12)
• logging to a remote database with mudpit Maetzky, Steffen (Extern) (May 13)
  • <Possible follow-ups>
  • RE: logging to a remote database with mudpit Lance Boon (May 13)
  • RE: logging to a remote database with mudpit Lance Boon (May 13)
• RE: snort and firewall all in one machine Harper, Patrick (May 13)
  • Re: snort and firewall all in one machine Peggy Kam (May 13)
• Detecting SYN Floods Sheahan, Paul (May 13)
• display/log IPv6 traffic ? Akolinare (May 13)
  • Re: display/log IPv6 traffic ? Dirk Geschke (May 14)
• RE: Snort-users digest, Vol 1 #4232 - 9 msgs MOUTON Michael OF/UNPS (May 13)
• question about the snort final stat Lin Zhong (May 13)
• FW: Administrativia: No advertising please Eric Hines (May 13)
  • Re: FW: Administrativia: No advertising please Frank Knobbe (May 13)
  • Re: FW: Administrativia: No advertising please Frank Knobbe (May 13)
  • Re: Administrativia: No advertising please Martin Roesch (May 14)
  • Re: FW: Administrativia: No advertising please James Riden (May 14)
  • <Possible follow-ups>
  • RE: Administrativia: No advertising please SRH-Lists (May 14)
    • Re: Administrativia: No advertising please Martin Roesch (May 14)
  • Re: Administrativia: No advertising please M. Jamil (May 14)
    • Re: Administrativia: No advertising please Martin Roesch (May 14)
  • RE: Administrativia: No advertising please Kreimendahl, Chad J (May 14)
• HTTP Protocol Analysis Sonika Malhotra (May 13)
  • Message not available
    • Re: HTTP Protocol Analysis Sonika Malhotra (May 14)
  • Re: HTTP Protocol Analysis Jason (May 14)
  • <Possible follow-ups>
  • Re: HTTP Protocol Analysis Sonika Malhotra (May 14)
  • Re: HTTP Protocol Analysis Ms.Sonika Malhotra (May 17)
    • Re: HTTP Protocol Analysis Keith W. McCammon (May 17)
• Re: Snort-users digest, Vol 1 #4234 - 12 msgs attechni (May 14)
  • Re: Re: Snort-users digest, Vol 1 #4234 - 12 msgs Jason (May 14)
• gigabit passive tap Istvan Csabai (May 14)
• Specific Host Filter Todd.Lambdin (May 14)
  • Re: Specific Host Filter Frank Knobbe (May 14)
  • RE: Specific Host Filter Eric Hines (May 14)
    • RE: Specific Host Filter Todd.Lambdin (May 14)
• Re: {SPAM} can Snort itself reconfigure a firewall Matt Kettler (May 14)
• Oinkmaster v1.0 released. Andreas Östling (May 15)
• localhost alert kev . p (May 15)
• SnortDB-Extra Issues Josh Berry (May 15)
• attack classification Marcin Laskowski (May 15)
  • <Possible follow-ups>
  • attack classification Marcin Laskowski (May 17)
• RE: Snort-users digest, Vol 1 #4239 - 5 msgs New Kabon (May 16)
• Methods for Analyzing Data Vernon Webb (May 16)
  • Re: Methods for Analyzing Data Keith W. McCammon (May 16)
• About virus.rules etienne . causse (May 17)
  • Message not available
    • Re: About virus.rules Matt Kettler (May 17)
      • Re: About virus.rules Michael Sconzo (May 17)
      • Re: About virus.rules Frank Knobbe (May 17)
      • Re: About virus.rules Michael Sconzo (May 17)
      • Re: About virus.rules Frank Knobbe (May 17)
      • Re: About virus.rules Jason Haar (May 17)
      • Re: About virus.rules kenw (May 29)
      • Re: About virus.rules Nick Hatch (May 29)
  • Re: About virus.rules nt (May 29)
• Snort is running, but doesn't fill IDS/ACID with alerts andreis (May 17)
  • <Possible follow-ups>
  • Snort is running, but doesn't fill IDS/ACID with alerts andreis (May 17)
    • question about snort... actually cvs john greene (May 17)
      • Re: question about snort... actually cvs Frank Knobbe (May 17)
• http_decode unknown preprocessor fatal error Alessandro Fiorenzi (May 17)
  • Re: http_decode unknown preprocessor fatal error Nerijus Krukauskas (May 18)
• help Lillebø Harald Sindre (May 18)
  • <Possible follow-ups>
  • help Garry Murdoch (Jun 24)
    • Re: help Matt Kettler (Jun 24)
      • Re: help sekure (Jun 24)
• Error starting stunnel Maetzky, Steffen (Extern) (May 18)
  • RE: Error starting stunnel Jeff Dell (May 18)
• Snort functionality I cant find? Derick Wong (May 18)
• Strange ICMP Ron Shuck (May 18)
  • <Possible follow-ups>
  • RE: Strange ICMP Baxter, Anthony (ABAXTER) (May 18)
• Tuning guidelines/HOWTO for flow-portscan anyone? McCash, John (May 18)
• future IPv6 version Rowland, Krisa W ERDC-ITL-MS Contractor (May 18)
  • Message not available
    • Re: future IPv6 version Matt Kettler (May 18)
• 2.1.3rc1 Performance Gary_Portnoy (May 18)
  • Re: 2.1.3rc1 Performance Dirk Geschke (May 19)
  • <Possible follow-ups>
  • Re: 2.1.3rc1 Performance Gary_Portnoy (May 19)
    • Re: 2.1.3rc1 Performance Dirk Geschke (May 19)
  • Re: 2.1.3rc1 Performance Gary_Portnoy (May 19)
  • RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 19)
  • RE: 2.1.3rc1 Performance Gary_Portnoy (May 19)
  • RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 19)
    • SnortCenter-Acid-SuSE byte_test issue Mike Feetham (May 19)
      • Re: SnortCenter-Acid-SuSE byte_test issue AJ Butcher, Information Systems and Computing (May 20)
  • RE: 2.1.3rc1 Performance Gary_Portnoy (May 19)
    • RE: 2.1.3rc1 Performance Dirk Geschke (May 19)
  • RE: 2.1.3rc1 Performance Gary_Portnoy (May 19)
    • RE: 2.1.3rc1 Performance Darren Webb (May 19)
  • RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 19)
  • RE: 2.1.3rc1 Performance John Creegan (May 19)
  • RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 19)
  • RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 20)
  • RE: 2.1.3rc1 Performance snort user (May 20)
  • RE: 2.1.3rc1 Performance Gary_Portnoy (May 20)
  • RE: 2.1.3rc1 Performance Kreimendahl, Chad J (May 20)
  • RE: 2.1.3rc1 Performance Gary_Portnoy (May 20)
• Code modification/s Arpan Acharya (May 18)
  • Re: Code modification/s Matt Kettler (May 19)
• Can snort output the total size of packets processed in the final statistic report? Lin Zhong (May 18)
• PortScan Configuration in snort.conf Ruiyuan Jiang (May 19)
  • RE: PortScan Configuration in snort.conf Michael Steele (May 19)
  • <Possible follow-ups>
  • RE: PortScan Configuration in snort.conf Ruiyuan Jiang (May 19)
• Flex-Response, anyone using it? Dusty Hall (May 19)
  • Re: Flex-Response, anyone using it? Paul Schmehl (May 19)
    • Re: Flex-Response, anyone using it? Jason Haar (May 19)
      • Re: Flex-Response, anyone using it? James Riden (May 19)
      • Re: Flex-Response, anyone using it? Jason (May 19)
      • Re: Flex-Response, anyone using it? James Riden (May 19)
      • Re: Flex-Response, anyone using it? Jason (May 20)
      • Re: Flex-Response, anyone using it? Jason (May 26)
      • Upgrading snort 2.0.* to -> 2.1.2 , and now i cant .... soldier Mx (Jun 07)
      • Re: Upgrading snort 2.0.* to -> 2.1.2 , and now i cant .... Michael Boman (Jun 07)
      • Re: Upgrading snort 2.0.* to -> 2.1.2 , and now i cant .... Michael Boman (Jun 09)
      • Re: Upgrading snort 2.0.* to -> 2.1.2 , and now i cant .... soldier Mx (Jun 10)
      • Re: Upgrading snort 2.0.* to -> 2.1.2 , and now i cant .... Michael Boman (Jun 10)
  • <Possible follow-ups>
  • FW: Flex-Response, anyone using it? IDont ThinkSo (May 20)
    • Re: FW: Flex-Response, anyone using it? Paul Schmehl (May 20)
  • RE: Flex-Response, anyone using it? CGhercoias (May 20)
    • Re: Flex-Response, anyone using it? James Riden (May 20)
• missing reference for correlation nyarlathothep () libero it (May 19)
• Re; Flex-Response, anyone using it? Richard Bejtlich (May 19)
  • Re: Re; Flex-Response, anyone using it? Marcin Laskowski (May 19)
  • Re: Re; Flex-Response, anyone using it? James Riden (May 19)
• http-decode SN ORT (May 19)
• Re; loopback traffic Richard Bejtlich (May 19)
  • Re: Re; loopback traffic Frank Knobbe (May 19)
• RE: snort tables (mysql) Truax, Shawn (MBS) (May 19)
• Ignoring arbitrary ports for certain rules AJ Butcher, Information Systems and Computing (May 20)
  • Re: Ignoring arbitrary ports for certain rules Matt Kettler (May 20)
    • Re: Ignoring arbitrary ports for certain rules AJ Butcher, Information Systems and Computing (May 21)
• how to handle this problem derk van de Velde (May 20)
  • Re: how to handle this problem AJ Butcher, Information Systems and Computing (May 20)
    • RE: how to handle this problem derk van de Velde (May 20)
      • RE: how to handle this problem AJ Butcher, Information Systems and Computing (May 20)
  • <Possible follow-ups>
  • RE: how to handle this problem Corey Rock (May 20)
    • RE: how to handle this problem derk van de Velde (May 21)
    • RE: (2) how to handle this problem derk van de Velde (May 21)
  • RE: how to handle this problem Corey Rock (May 22)
• Logging specific alerts to syslog Devanathan, Balaji (Corporate, consultant) (May 20)
  • RE: Logging specific alerts to syslog Jeff Dell (May 20)
• Snort and high performance networks Christopher Rapier (May 20)
  • R: Snort and high performance networks Fausto Marzi (May 20)
  • Re: Snort and high performance networks Jeff Coppock (May 21)
  • <Possible follow-ups>
  • RE: Snort and high performance networks Kreimendahl, Chad J (May 20)
    • Re: Snort and high performance networks Christopher Rapier (May 20)
  • RE: Snort and high performance networks Kreimendahl, Chad J (May 20)
    • Re: Snort and high performance networks Chris Rapier (May 20)
    • RE: Snort and high performance networks Rafael Ortega (Jun 01)
  • RE: Snort and high performance networks Kreimendahl, Chad J (May 20)
  • RE: Snort and high performance networks Rafael Ortega (May 21)
    • Re: Snort and high performance networks Jason Haar (May 23)
  • RE: Snort and high performance networks snort user (May 21)
    • Re: Snort and high performance networks Christopher Rapier (May 21)
    • RE: Snort and high performance networks Rafael Ortega (May 21)
  • Re: Snort and high performance networks snort user (May 21)
  • RE: Snort and high performance networks SN ORT (May 21)
  • RE: Snort and high performance networks Kreimendahl, Chad J (May 21)
  • Re: Snort and high performance networks Aaron (May 24)
    • High Speed Network Cards + rules? Adriel T. Desautels (May 24)
      • Re: High Speed Network Cards + rules? Keith W. McCammon (May 24)
      • Re: High Speed Network Cards + rules? Christopher Rapier (May 24)
      • Re: High Speed Network Cards + rules? Matt Kettler (May 24)
      • Re: High Speed Network Cards + rules? James Riden (May 24)
      • Re: High Speed Network Cards + rules? James Riden (May 25)
      • Re: High Speed Network Cards + rules? Tod Beardsley (May 24)
    • Re: Re: Snort and high performance networks Micha Silver (May 25)
      • Re: Re: Snort and high performance networks Aaron (May 25)
      • Re: Re: Snort and high performance networks Micha Silver (May 26)
  • RE: Snort and high performance networks Esler, Joel - Contractor (Jun 01)
    • Re: Snort and high performance networks Chris Rapier (May 20)
  • RE: Snort and high performance networks Corey Rock (Jun 03)
• Sensor Agent at Remote machine Naveen C Joshi (May 20)
  • RE: Sensor Agent at Remote machine Naveen C Joshi (May 24)
• GRE preprocessor Jenkinson, John P (SAIC) (May 20)
• BACKDOOR QAZ Worm Client Login access? False positive? sart (May 20)
  • Message not available
    • Re: BACKDOOR QAZ Worm Client Login access? Matt Kettler (May 20)
      • Re: BACKDOOR QAZ Worm Client Login access? sart (May 21)
• About to setup snort Shaun T. Erickson (May 20)
  • Re: About to setup snort James Edwards (May 20)
  • <Possible follow-ups>
  • RE: About to setup snort Truax, Shawn (MBS) (May 20)
    • Re: About to setup snort Shaun T. Erickson (May 21)
  • Re: About to setup snort Richard Bejtlich (May 20)
    • Re: Re: About to setup snort Shaun T. Erickson (May 21)
      • Re: Re: About to setup snort Bamm Visscher (May 22)
• which rules to download lola marais (May 20)
  • ANVIL Adriel T. Desautels (May 20)
    • Future plans Paul Schmehl (May 26)
  • Re: which rules to download Matt Kettler (May 20)
  • <Possible follow-ups>
  • Re: which rules to download lola marais (May 20)
• Come hither payload Gould, Scott (May 20)
  • <Possible follow-ups>
  • RE: Come hither payload Gould, Scott (May 20)
• RE: ANVIL - WAS [Snort-users] which rules to download Harper, Patrick (May 21)
  • RE: ANVIL - WAS [Snort-users] which rules to download Adriel T. Desautels (May 21)
• 2.1.3rc1 Performance RESULTS Gary_Portnoy (May 21)
  • <Possible follow-ups>
  • RE: 2.1.3rc1 Performance RESULTS Kreimendahl, Chad J (May 21)
  • RE: 2.1.3rc1 Performance RESULTS Gary_Portnoy (May 21)
    • RE: 2.1.3rc1 Performance RESULTS Dirk Geschke (May 22)
• Port mirroring Boswell, Richard (May 21)
  • Re: Port mirroring Matt Kettler (May 21)
• RE: ANVIL - WAS [Snort-users] which rules to download Corey Rock (May 21)
• Why the EAP traffic do not show in the snort final stat? Lin Zhong (May 21)
• Can snort use an unconfigured interface? Shaun T. Erickson (May 21)
  • Re: Can snort use an unconfigured interface? Bennett Todd (May 21)
    • Re: Can snort use an unconfigured interface? Shaun T. Erickson (May 21)
  • Re: Can snort use an unconfigured interface? Matt Kettler (May 21)
  • <Possible follow-ups>
  • RE: Can snort use an unconfigured interface? Corey Rock (May 21)
• Packet Payload database? Scott Zawalski (May 21)
  • Re: [Snort-sigs] Packet Payload database? Rodrigo Ramos (May 22)
• The logged snort alert # and the final stat do not match Lin Zhong (May 21)
• Libnet 1.0.2a with Libnet 1.1.x Joshua Berry (May 21)
  • Re: Libnet 1.0.2a with Libnet 1.1.x Dirk Geschke (May 21)
  • <Possible follow-ups>
  • RE: Libnet 1.0.2a with Libnet 1.1.x Joshua Berry (May 21)
• massive rule update coming Brian (May 21)
• RE: Come hither payload--->>>Fixed Gould, Scott (May 21)
  • barnyard manual bonnie buwono (May 21)
• are snortalog thing ok here derk van de Velde (May 22)
  • Re: are snortalog thing ok here Cédric BLIN (May 24)
  • Re: are snortalog thing ok here jeremy chartier (May 24)
    • RE: are snortalog thing ok here derk van de Velde (May 24)
      • Re: are snortalog thing ok here jeremy chartier (May 24)
• where can i find the relation derk van de Velde (May 22)
• flow-portscan. Chris Keladis (May 23)
  • Snort-Wireless on Linksys WRT54G Steffen Pfendtner (May 23)
• Fatal Error cause snort can not startup kinux (May 24)
  • <Possible follow-ups>
  • RE: Fatal Error cause snort can not startup Harper, Patrick (May 24)
  • RE: Fatal Error cause snort can not startup SN ORT (May 24)
• Snort getting RNA-like overhaul? Keith W. McCammon (May 24)
  • Re: Snort getting RNA-like overhaul? Sam (May 24)
• Partial system crash while snort exiting Richard Lang (May 24)
• Disable rules Jorge Cláudio (May 24)
  • Re: Disable rules Matt Kettler (May 24)
  • <Possible follow-ups>
  • RE: Disable rules Harper, Patrick (May 24)
• Re: [Snort-sigs] RE: Ignoring Win32 SNMP printer checks Nerijus Krukauskas (May 24)
• Forcing mudpit to use a special port for stunnel Maetzky, Steffen (Extern) (May 25)
• RE: Forcing mudpit to use a special port for stunne l McGuire, Dennis (May 25)
• Barnyard woes David (May 25)
  • Re: Barnyard woes Dirk Geschke (May 25)
  • Re: Barnyard woes Bamm Visscher (May 25)
  • <Possible follow-ups>
  • RE: Barnyard woes VanBrecht, Jason (May 25)
  • Re: Barnyard woes David (May 26)
• snort-wireless on Linksys WRT54G wireless (May 25)
• question about barnyard logging to remote mySQL database. Timothy W Morrison (May 25)
  • Re: question about barnyard logging to remote mySQL database. Bamm Visscher (May 25)
• AW: Barnyard woes Maetzky, Steffen (Extern) (May 25)
• Gaobot worm Pat Delaney (May 25)
  • Message not available
    • Re: Gaobot worm Matt Kettler (May 26)
• How to Triggering Windows Exploits? ids (May 25)
  • <Possible follow-ups>
  • RE: How to Triggering Windows Exploits? Joshua Berry (May 25)
  • Re: RE: How to Triggering Windows Exploits? ids (May 25)
    • Re: How to Triggering Windows Exploits? James Riden (May 25)
      • RE: How to Triggering Windows Exploits? Alan (May 26)
  • RE: RE: How to Triggering Windows Exploits? Alan (May 26)
    • RE: RE: How to Triggering Windows Exploits? Alan (May 26)
  • Re: RE: How to Triggering Windows Exploits? Hendo (May 26)
• Snort Block Plugin. akhenato () montevideo com uy (May 26)
  • Re: Snort Block Plugin. Matt Kettler (May 26)
    • Re: Snort Block Plugin. akhenato () montevideo com uy (May 26)
  • <Possible follow-ups>
  • Re: Snort Block Plugin. Nicolas Saurbier (May 26)
  • RE: Snort Block Plugin. CGhercoias (May 26)
• wildcards in rules? Sheahan, Paul (May 26)
  • Message not available
    • Re: wildcards in rules? Matt Kettler (May 26)
• Why the alert # in the snort final stat do not match the alert # in log? Lin Zhong (May 26)
• Snort 2.1.3rc1 core dump Gary_Portnoy (May 26)
  • Re: Snort 2.1.3rc1 core dump Dirk Geschke (May 27)
  • Re: Snort 2.1.3rc1 core dump Jeremy Hewlett (May 27)
• Custom rules Devanathan, Balaji (Corporate, consultant) (May 26)
• Honeynet Security Console 1.0 Final Released Jeff Dell (May 27)
• RE: Problems with jpgraph and ACID . rod (May 27)
  • <Possible follow-ups>
  • RE: Problems with jpgraph and ACID . rod (Jun 01)
  • RE: Problems with jpgraph and ACID . rod (Jun 01)
• Guardian with Snort claudio antonio (May 27)
  • RES: Guardian with Snort Franco Catena (Jun 08)
    • Re: RES: Guardian with Snort bonnie buwono (Jun 08)
• Stream4 Mangling? SRH-Lists (May 27)
  • RE: Stream4 Mangling? Jim Cervantes (May 27)
• Apache/Acid + server Cilin (May 27)
  • Re: Apache/Acid + server James Riden (May 27)
  • <Possible follow-ups>
  • Re: Apache/Acid + server Nigel Houghton (May 28)
• Suspect activity: proxy scan attempts, SNMP access, etc Saken Seifullin (May 27)
  • <Possible follow-ups>
  • Re: Suspect activity: proxy scan attempts, SNMP access, etc Saken Seifullin (Jun 06)
    • Re: Suspect activity: proxy scan attempts, SNMP access, etc Sean Lazar (Jun 06)
• barnyard problem Jasmine CHUA (May 28)
  • <Possible follow-ups>
  • RE: barnyard problem David (May 28)
• Snort not Alerting Shaun Gray (May 28)
• Snort, Barnyard, Acid - Lack of paylod John J. Nagro (May 28)
  • Re: Snort, Barnyard, Acid - Lack of paylod Michael Anderson (May 28)
    • Message not available
      • Re: Snort, Barnyard, Acid - Lack of paylod Michael Anderson (Jun 01)
• OT: ACID php pre-req question. Shaun T. Erickson (May 28)
• Snort capturing ARP packets sgt_b (May 28)
  • <Possible follow-ups>
  • RE: Snort capturing ARP packets David (May 28)
• Typot BACKDOOR _JusSx_ (May 28)
  • <Possible follow-ups>
  • RE: Typot BACKDOOR David (May 28)
• system setup for SNORT: looking for recommendation Jeff Schmidt (CACL Tech Asst) (May 28)
  • Re: system setup for SNORT: looking for recommendation twig les (May 28)
  • Re: system setup for SNORT: looking for recommendation AJ Butcher, Information Systems and Computing (Jun 01)
• Not loggin to MySQL Database Vernon Webb (May 28)
  • <Possible follow-ups>
  • RE: Not loggin to MySQL Database David (May 29)
  • RE: Not loggin to MySQL Database Truax, Shawn (MBS) (May 29)
  • RE: Not loggin to MySQL Database Harper, Patrick (Jun 01)
    • RE: Not loggin to MySQL Database Vernon Webb (Jun 01)
• performance monitoring nt (May 29)
  • RE: performance monitoring Darren Webb (May 29)
  • Re: performance monitoring Erik Fichtner (May 29)
  • Re: performance monitoring AJ Butcher, Information Systems and Computing (Jun 01)
• Flow Portscan James Ashton (May 29)
  • Re: Flow Portscan Chris Green (Jun 01)
• BARE BYTE UNICODE ENCODING Annie Green (May 29)
  • <Possible follow-ups>
  • BARE BYTE UNICODE ENCODING Annie Green (Jun 01)
  • Bare Byte Unicode Encoding Pedro Jorge Barradas (Jun 02)
  • RE: Bare Byte Unicode Encoding Pedro Jorge Barradas (Jun 02)
• 100 Client VPN Steven Coutts (May 31)
  • Re: 100 Client VPN The Shell (May 31)
  • Re: 100 Client VPN Steven Coutts (May 31)
• Unknown rule type: iis_unicode_map Mark Wade (May 31)
  • <Possible follow-ups>
  • RE: Unknown rule type: iis_unicode_map Harper, Patrick (Jun 01)
• RE: Snort-users digest, Vol 1 #4273 - 4 msgs Pedro Jorge Barradas (Jun 01)
• Only half off topic..maybe Jeff Price (Jun 01)
  • <Possible follow-ups>
  • RE: Only half off topic..maybe Harper, Patrick (Jun 01)
    • Re: Only half off topic..maybe Jeff Price (Jun 01)
      • Re: Only half off topic..maybe David Alonso De La Vega Tapage (Jun 02)
  • RE: Only half off topic..maybe Harper, Patrick (Jun 02)
• Snort, Apache, PHP, MySQL and Acid installation problem with SNORT Ramesh Pillai (Jun 01)
  • <Possible follow-ups>
  • RE: Snort, Apache, PHP, MySQL and Acid installation problem with SNORT Harper, Patrick (Jun 01)
• patch for flow portscan preprocessor's deficient logging Holt Sorenson (Jun 01)
• I don't understand this snort alert, "NETBIOS SMB IPC$ share unicode ....{ICMP}" L HR (Jun 01)
• Case Study Leland (Jun 01)
• Did they read it? email tracking service Dave Dearinger (Jun 01)
  • Re: Did they read it? email tracking service Matt Kettler (Jun 01)
  • Re: Did they read it? email tracking service Matt Kettler (Jun 01)
• Samba and "BAD-TRAFFIC 0 ttl" alerts hugh_fraser (Jun 01)
  • Re: Samba and "BAD-TRAFFIC 0 ttl" alerts Max Valdez (Jun 01)
• ACID setup question Shaun T. Erickson (Jun 01)
  • Re: ACID setup question Paul Schmehl (Jun 01)
    • Re: ACID setup question Shaun T. Erickson (Jun 01)
      • Re: ACID setup question Paul Schmehl (Jun 01)
      • Re: ACID setup question Shaun T. Erickson (Jun 01)
      • Re: ACID setup question Shaun T. Erickson (Jun 02)
      • Re: ACID setup question Paul Schmehl (Jun 02)
      • Re: ACID setup question Shaun T. Erickson (Jun 02)
      • Re: ACID setup question Paul Schmehl (Jun 02)
• Enabling Flex-resp simonkc (Jun 01)
  • Re: Enabling Flex-resp Guillaume Arcas (Jun 02)
• Snort on Mac OSX Eric (Jun 02)
  • Re: Snort on Mac OSX Guillaume Arcas (Jun 02)
  • Re: Snort on Mac OSX Doug Nordwall (Jun 04)
  • RE: Snort on Mac OSX Joel Esler (Jun 09)
  • <Possible follow-ups>
  • RE: Snort on Mac OSX Michael Shirk (Jun 07)
    • RE: Snort on Mac OSX Guillaume Arcas (Jun 07)
• Snort& Intrusion Prevention Maetzky, Steffen (Extern) (Jun 02)
  • Re: Snort& Intrusion Prevention Frank Knobbe (Jun 02)
  • Message not available
    • Re: Snort& Intrusion Prevention Matt Kettler (Jun 02)
  • <Possible follow-ups>
  • RE: Snort& Intrusion Prevention Joshua Berry (Jun 03)
• Flexresp: react combined with a content-list Maetzky, Steffen (Extern) (Jun 02)
• updating snort rules with oinkmaster Pascal.Dubach (Jun 02)
  • Re: updating snort rules with oinkmaster John J. Nagro (Jun 02)
  • Re: updating snort rules with oinkmaster Andreas Östling (Jun 02)
• No mysql support error Cockerham, John (US SSA) (Jun 02)
  • <Possible follow-ups>
  • RE: No mysql support error Jeff Evenson (Jun 02)
  • RE: No mysql support error Harper, Patrick (Jun 02)
• Snort Installation on Win2K problems geomax (Jun 02)
  • RE: Snort Installation on Win2K problems Michael Steele (Jun 02)
• Bug with pcap filters? Jason Haar (Jun 02)
• L3 retriever false positive for windows ping? Corey Rock (Jun 02)
• RE: Stream4 Mangling? (more details/debugging) SRH-Lists (Jun 02)
  • <Possible follow-ups>
  • RE: Stream4 Mangling? (more details/debugging) SRH-Lists (Jun 03)
• Unsubscribe CC8(fzlXaB"HH( Scott Charleson (Jun 02)
• Cant see alert for rule Tom Fulton (Jun 02)
  • RE: Cant see alert for rule Tom Fulton (Jun 02)
    • Re: Cant see alert for rule Jeff Coppock (Jun 02)
      • RE: Cant see alert for rule Tom Fulton (Jun 02)
      • RE: Cant see alert for rule Tom Fulton (Jun 02)
  • <Possible follow-ups>
  • RE: Cant see alert for rule Harper, Patrick (Jun 02)
  • Re: Cant see alert for rule SN ORT (Jun 03)
    • HOME_NET question sart (Jun 03)
  • RE: Cant see alert for rule Tom Fulton (Jun 03)
• Alert classification and priority Gary_Portnoy (Jun 02)
  • Re: Alert classification and priority Dirk Geschke (Jun 03)
  • <Possible follow-ups>
  • Re: Alert classification and priority Gary_Portnoy (Jun 03)
    • Re: Alert classification and priority Dirk Geschke (Jun 03)
  • Re: Alert classification and priority SN ORT (Jun 03)
• Snort 2.1.3 Released Jeremy Hewlett (Jun 02)
  • Excluding IPs in HOME_NET? Paul Martin (Jun 03)
• Snort VoIP derek-murphy (Jun 02)
• AW: Snort& Intrusion Prevention Maetzky, Steffen (Extern) (Jun 03)
  • Message not available
    • Re: AW: Snort& Intrusion Prevention Matt Kettler (Jun 03)
      • RE: AW: Snort& Intrusion Prevention Eric Hines (Jun 03)
  • Re: AW: Snort& Intrusion Prevention Ravi Kumar (Jun 03)
• Snort Logs [HITCON VIRUS CHECK: OK] Maik . Linnemann (Jun 03)
  • <Possible follow-ups>
  • RE: Snort Logs [HITCON VIRUS CHECK: OK] Miner, Jonathan W (CSC) (US SSA) (Jun 03)
  • Re: Re: Snort Logs [HITCON VIRUS CHECK: OK] Maik . Linnemann (Jun 03)
• Burp! Schmehl, Paul L (Jun 03)
• Linux Newb:No Alert Logging Shaun Gray (Jun 03)
  • <Possible follow-ups>
  • RE: Linux Newb:No Alert Logging Harper, Patrick (Jun 03)
  • RE: Linux Newb:No Alert Logging Shaun Gray (Jun 03)
• re: alert archive question Lindsay Hunt (Jun 03)
• RE: Excluding IPs in HOME_NET? Harper, Patrick (Jun 03)
  • <Possible follow-ups>
  • RE: Excluding IPs in HOME_NET? SRH-Lists (Jun 03)
    • RE: Excluding IPs in HOME_NET? AJ Butcher, Information Systems and Computing (Jun 04)
      • flowbits together with stream4_reassemble question Per Kristian Johnsen (Jun 09)
• ACID Graphs SN ORT (Jun 03)
  • Re: ACID Graphs Bryan Irvine (Jun 03)
• Danny Li/AP/NSC is out of the office. Danny Li (Jun 03)
  • <Possible follow-ups>
  • Danny Li/AP/NSC is out of the office. Danny Li (Jun 10)
• Find out your snort database size Lance Boon (Jun 03)
• re: snort archive database question Lindsay Hunt (Jun 03)
• When does snort/ACID do DNS lookups Humes, David G. (Jun 03)
  • RE: When does snort/ACID do DNS lookups Adriel T. Desautels (Jun 03)
    • RE: When does snort/ACID do DNS lookups todb (Jun 03)
  • <Possible follow-ups>
  • RE: When does snort/ACID do DNS lookups Truax, Shawn (MBS) (Jun 04)
• RE: HOME_NET question Truax, Shawn (MBS) (Jun 04)
• Anyone using SnortCenter w/ ACiD? Timothy W Morrison (Jun 04)
  • Re: Anyone using SnortCenter w/ ACiD? AJ Butcher, Information Systems and Computing (Jun 04)
    • RE: Anyone using SnortCenter w/ ACiD? Naveen C Joshi (Jun 04)
      • FAQ: RE: Anyone using SnortCenter w/ ACiD? AJ Butcher, Information Systems and Computing (Jun 04)
• ru.le to detect lots of syn pkts? Rich Adamson (Jun 04)
  • Re: ru.le to detect lots of syn pkts? AJ Butcher, Information Systems and Computing (Jun 04)
  • Re: ru.le to detect lots of syn pkts? Paul Schmehl (Jun 04)
    • Re: ru.le to detect lots of syn pkts? Rich Adamson (Jun 04)
      • Re: ru.le to detect lots of syn pkts? Rich Adamson (Jun 04)
  • Re: ru.le to detect lots of syn pkts? Matt Kettler (Jun 04)
  • <Possible follow-ups>
  • Re: ru.le to detect lots of syn pkts? Paul Schmehl (Jun 04)
    • Re: ru.le to detect lots of syn pkts? Rich Adamson (Jun 04)
      • Re: ru.le to detect lots of syn pkts? Paul Schmehl (Jun 04)
• How do I upgrade Snort to the latest version? Lance Boon (Jun 04)
  • Re: How do I upgrade Snort to the latest version? Doug Nordwall (Jun 04)
  • <Possible follow-ups>
  • RE: How do I upgrade Snort to the latest version? Lance Boon (Jun 04)
• Help please: libpcre.so.0: cannot open shared... Gustavo Gomes (Jun 04)
  • Re: Help please: libpcre.so.0: cannot open shared... Matt Kettler (Jun 04)
  • <Possible follow-ups>
  • RE: Help please: libpcre.so.0: cannot open shared... David (Jun 04)
  • RE: Help please: libpcre.so.0: cannot open shared... Corey Rock (Jun 05)
  • RE: Help please: libpcre.so.0: cannot open shared... Lorenz.Graf (Jun 06)
• Snort and ACID - how to determine if logging is happening correctly Jeff Schmidt (CACL Tech Asst) (Jun 04)
  • Re: Snort and ACID - how to determine if logging is happening correctly Timothy W Morrison (Jun 07)
• Barnyard w/ mysql issues Phinizy William (Jun 04)
  • <Possible follow-ups>
  • Re: Barnyard w/ mysql issues Richard Bejtlich (Jun 04)
  • RE: Re: Barnyard w/ mysql issues Phinizy William (Jun 04)
• Win32 v2.13 build 27 problem Rich Adamson (Jun 04)
• Eagle X Like Instillation for Linux steve (Jun 04)
  • <Possible follow-ups>
  • RE: Eagle X Like Instillation for Linux Corey Rock (Jun 05)
• Multiple Snort sensor with MYSQL and ACID Primero (Jun 05)
  • RE: Multiple Snort sensor with MYSQL and ACID Jeff Dell (Jun 05)
  • <Possible follow-ups>
  • Multiple Snort sensor with MYSQL and ACID Primero (Jun 05)
  • RE: Multiple Snort sensor with MYSQL and ACID Gould, Scott (Jun 05)
• PHP complaint about GD Snort IDS (Jun 05)
• toll for snort rules management Primero (Jun 05)
  • RE: toll for snort rules management Jeff Dell (Jun 05)
• Snort for Windows Memory Climbing Eric Knight (Jun 06)
• Event-Correlation& avoiding false positives Maetzky, Steffen (Extern) (Jun 07)
  • <Possible follow-ups>
  • RE: Event-Correlation& avoiding false positives Kreimendahl, Chad J (Jun 07)
    • RE: Event-Correlation& avoiding false positives Eric Hines (Jun 07)
      • Re: Event-Correlation& avoiding false positives Brian (Jun 07)
  • RE: Event-Correlation& avoiding false positives hugh_fraser (Jun 08)
    • Re: Event-Correlation& avoiding false positives DK (Jun 08)
• AW: Upgrading snort 2.0.* to -> 2.1.2 , and now i c ant .... Poppi, Sandro (Jun 07)
• flowbits together with stream4_reassemble question Per Kristian (Jun 07)
  • <Possible follow-ups>
  • flowbits together with stream4_reassemble question Per Kristian Johnsen (Jun 09)
  • flowbits together with stream4_reassemble question Per Kristian Johnsen (Jun 09)
• Classification of Snort-Rules into Applications kinek (Jun 07)
  • Classification of Snort-Rules into Applications kinek (Jun 07)
• Re: Upgrading snort 2.0.* to -> 2.1.2 , and now i cant .... Gary_Portnoy (Jun 07)
• what does it mean ? Laskowski (Jun 07)
  • <Possible follow-ups>
  • what does it mean ? Laskowski (Jun 09)
• trouble connecting barnyard to a remote mysql database. Timothy W Morrison (Jun 07)
  • <Possible follow-ups>
  • RE: trouble connecting barnyard to a remote mysql database. Lance Boon (Jun 07)
    • RE: trouble connecting barnyard to a remote mysql database. Timothy W Morrison (Jun 07)
• Testing Snort? Jeff Schmidt (CACL Tech Asst) (Jun 07)
  • RE: Testing Snort? Jeff Dell (Jun 07)
  • Re: Testing Snort? mbusigin (Jun 07)
  • Re: Testing Snort? Michael Sconzo (Jun 07)
  • Re: Testing Snort? sgt_b (Jun 07)
  • <Possible follow-ups>
  • RE: Testing Snort? Richard Bejtlich (Jun 07)
• Can you see anything wrong with these rules/snort.conf? Tom Fulton (Jun 07)
• how to delete records from acid? Primero (Jun 07)
  • Re: how to delete records from acid? Jeff Coppock (Jun 08)
• Tools for sending email alerts from snort Travis . Landry (Jun 08)
  • Re: Tools for sending email alerts from snort Dirk Geschke (Jun 08)
  • <Possible follow-ups>
  • RE: Tools for sending email alerts from snort Joshua Berry (Jun 08)
  • RE: Tools for sending email alerts from snort Edwin Beekman (Jun 08)
  • RE: Tools for sending email alerts from snort Harper, Patrick (Jun 09)
• Mudpit & pcap. Chris Keladis (Jun 08)
• snort data sheet mark jon (Jun 08)
  • <Possible follow-ups>
  • RE: snort data sheet Corey Rock (Jun 10)
• Taps, Rx Only Cables & Hubs - Which one(s)? Jim Richards (Jun 08)
  • Re: Taps, Rx Only Cables & Hubs - Which one(s)? Rich Adamson (Jun 08)
  • Re: Taps, Rx Only Cables & Hubs - Which one(s)? Matt Kettler (Jun 08)
    • Snort + Guardian + Acid dont run Franco Catena (Jun 09)
      • Re: Snort + Guardian + Acid dont run Alejandro Flores (Jun 09)
      • Re: Snort + Guardian + Acid dont run pvm (Jun 09)
  • <Possible follow-ups>
  • Taps, Rx Only Cables & Hubs - Which one(s)? Jim Richards (Jun 08)
  • Taps, Rx Only Cables & Hubs - Which one(s)? Jim Richards (Jun 08)
  • RE: Taps, Rx Only Cables & Hubs - Which one(s)? Mike Walter (Jun 08)
• Landesk Joshua Berry (Jun 08)
• TFTP root directory alert Rowland, Krisa W ERDC-ITL-MS Contractor (Jun 08)
  • RE: TFTP root directory alert Jerry Shenk (Jun 08)
  • Message not available
    • Re: TFTP root directory alert Matt Kettler (Jun 08)
• Promiscuous fails with -D Brei, Matt (Jun 08)
  • <Possible follow-ups>
  • RE: Promiscuous fails with -D Corey Rock (Jun 11)
  • RE: Promiscuous fails with -D Corey Rock (Jun 11)
• Where I can find a tap to buy? Gustavo Gomes (Jun 08)
  • Re: Where I can find a tap to buy? Matt Kettler (Jun 08)
  • <Possible follow-ups>
  • Re: Where I can find a tap to buy? Ty Bodell (Jun 08)
• Regaring SnortCentre Jospeh (Jun 08)
  • <Possible follow-ups>
  • Regaring SnortCentre Jospeh (Jun 09)
• Snort Frontend on Windows Jospeh (Jun 08)
  • RE: Snort Frontend on Windows Jeff Dell (Jun 08)
  • <Possible follow-ups>
  • Re: Snort Frontend on Windows Ty Bodell (Jun 08)
• SnortDB Extra Joshua Berry (Jun 08)
  • <Possible follow-ups>
  • Re: SnortDB Extra Gary_Portnoy (Jun 09)
  • RE: SnortDB Extra Joshua Berry (Jun 09)
• Report a bug? Rich Adamson (Jun 08)
  • Re: Report a bug? Jeremy Hewlett (Jun 09)
• visual DB sheme Knobloch, Katherine (Jun 08)
  • RE: visual DB sheme Jeff Dell (Jun 08)
• create a html page with snort mysql db Jan Hormann (Jun 09)
  • Re: create a html page with snort mysql db Nerijus Krukauskas (Jun 09)
    • Re: create a html page with snort mysql db Jan Hormann (Jun 09)
  • Re: create a html page with snort mysql db prabu (Jun 09)
  • <Possible follow-ups>
  • RE: create a html page with snort mysql db McGuire, Dennis (Jun 09)
  • RE: create a html page with snort mysql db Edwin Beekman (Jun 09)
    • Re: create a html page with snort mysql db Nerijus Krukauskas (Jun 10)
• Information Snort 2.1.3 Rodrigo Ramos (Jun 09)
  • Re: Information Snort 2.1.3 Brian (Jun 09)
• Setting up Oinkmaster Lance Boon (Jun 09)
  • Adding outbound rules to snort ruleset Jerry Shenk (Jun 09)
• Barnyard newbie questions. Shaun T. Erickson (Jun 09)
  • <Possible follow-ups>
  • RE: Barnyard newbie questions. Lance Boon (Jun 09)
• RE: Adding outbound rules to snort ruleset Williams Jon (Jun 09)
  • RE: Adding outbound rules to snort ruleset Jerry Shenk (Jun 09)
• windows 2000 snort and promiscuous mode interfaces Robert . Perez (Jun 09)
• Intrusion Prevention System Ragip Yahsieli (Jun 09)
  • Re: Intrusion Prevention System Michael Sconzo (Jun 09)
  • <Possible follow-ups>
  • RE: Intrusion Prevention System Harper, Patrick (Jun 10)
• Use Snort to detect viruses? Justin McLeod (Jun 09)
  • Re: Use Snort to detect viruses? Matt Kettler (Jun 09)
• Easy way to test snort Marc Daniels (Jun 09)
  • Re: Easy way to test snort todb (Jun 09)
• W32.HLLW.Nebiwo Rule Jose De Leon (Jun 09)
• Problems with IDS File of Snort (Jun 09)
  • Re: Problems with IDS File of Snort Cédric BLIN (Jun 10)
• Multiple instances of snort on a bonded interface Miles Stevenson (Jun 09)
  • <Possible follow-ups>
  • RE: Multiple instances of snort on a bonded interface Corey Rock (Jun 11)
    • Re: Multiple instances of snort on a bonded interface Miles Stevenson (Jun 11)
• New Sguil 0.4.0 installation guide Richard Bejtlich (Jun 09)
• Spyware rules for Snort Jason Haar (Jun 09)
  • Re: Spyware rules for Snort Keith W. McCammon (Jun 10)
• Really cheeky feature request Jason Haar (Jun 09)
• SID in syslog messages Devanathan, Balaji (Corporate, consultant) (Jun 09)
• AW: Barnyard newbie questions. Maetzky, Steffen (Extern) (Jun 10)
  • Re: AW: Barnyard newbie questions. Shaun T. Erickson (Jun 10)
  • <Possible follow-ups>
  • RE: AW: Barnyard newbie questions. Truax, Shawn (MBS) (Jun 10)
  • Re: AW: Barnyard newbie questions. Tom Arseneault (Jun 10)
• Wu-Manber, Aho-Corasick, Boyer Moore. kinek (Jun 10)
  • Re: Wu-Manber, Aho-Corasick, Boyer Moore. Matt Kettler (Jun 11)
• Type:11 Code:0 TTL EXCEEDED IN TRANSIT Franco Catena (Jun 10)
• Snort-Inline on RedHat 9 HowTo Maetzky, Steffen (Extern) (Jun 10)
  • RE: Snort-Inline on RedHat 9 HowTo Jeff Dell (Jun 10)
• Announcement PigMail v. 1.01 Adam Ely (Jun 10)
  • When did this change? Paul Schmehl (Jun 27)
    • RE: When did this change? Jeff Dell (Jun 27)
      • RE: When did this change? Paul Schmehl (Jun 27)
      • RE: When did this change? Frank Knobbe (Jun 29)
      • RE: When did this change? Jeff Dell (Jun 29)
• Favorite Ethernet Tap's Gary Borgeson (Jun 10)
  • <Possible follow-ups>
  • RE: Favorite Ethernet Tap's Kreimendahl, Chad J (Jun 10)
  • RE: Favorite Ethernet Tap's Gould, Scott (Jun 10)
  • RE: Favorite Ethernet Tap's CGhercoias (Jun 11)
• Problems with Snort on SuSE Linux 9.1 (Kernel 2.6) Eric Hines (Jun 10)
  • RE: Problems with Snort on SuSE Linux 9.1 (Kernel 2.6) Tom Fulton (Jun 10)
    • Re: Problems with Snort on SuSE Linux 9.1 (Kernel 2.6) Eric Hines (Jun 10)
• Snort and MySQL - clearing alerts George Laiacona (Jun 10)
  • Re: Snort and MySQL - clearing alerts Paul Schmehl (Jun 10)
• Snort IDS OUTPUT TO PRINTER Aaron Russ (Jun 10)
  • RE: Snort IDS OUTPUT TO PRINTER Jerry Shenk (Jun 11)
• using a tap Altrock, Jens (Jun 10)
  • Re: using a tap Michael Boman (Jun 10)
  • <Possible follow-ups>
  • RE: using a tap Gould, Scott (Jun 11)
• SNORT 101 IDS - HELP Hari Om (Jun 11)
• RE: Disable alerts from certain machines - Not working for me? Snortty (Jun 11)
• VoIP Vulnerabilities Grant Macaulay (Jun 11)
  • <Possible follow-ups>
  • RE: VoIP Vulnerabilities Jeremy Junginger (Jun 11)
• Timezone issue Mike Feetham (Jun 11)
• RE: Favorite Ethernet Tap SN ORT (Jun 11)
  • Re: RE: Favorite Ethernet Tap Jeff Price (Jun 15)
• catching many-to-one attacks twig les (Jun 11)
• Ready! Set! ... Nothing :-/ Shaun T. Erickson (Jun 11)
  • Re: Ready! Set! ... Nothing :-/ Shaun T. Erickson (Jun 13)
    • Snort message: Unable to create an IPSet from any ... ? James Sinnamon (Jun 15)
      • Re: Snort message: Unable to create an IPSet from any ... ? Mike Mestnik (Jun 15)
  • <Possible follow-ups>
  • Re: Ready! Set! ... Nothing :-/ David (Jun 14)
• AW: using a tap Altrock, Jens (Jun 13)
• Problems to install Snort on Fedora RC2 Karl-Heinz Schulz (Jun 13)
  • Re: Problems to install Snort on Fedora RC2 Brian (Jun 14)
• 2.1.3 Multiple events/packet sekure (Jun 14)
  • Re: 2.1.3 Multiple events/packet sekure (Jun 16)
• DC SUG Meeting - Next Thurs., June 24 Keith W. McCammon (Jun 14)
• Windows32 Snort without WPcap.dll? Steven Bairstow (Jun 14)
  • Re: Windows32 Snort without WPcap.dll? Keith W. McCammon (Jun 14)
    • Re: Windows32 Snort without WPcap.dll? Steven Bairstow (Jun 14)
  • RE: Windows32 Snort without WPcap.dll? Michael Steele (Jun 15)
• Export variables into snort startup process DeBerry, Casey (Jun 14)
  • RE: Export variables into snort startup process Brian Jameson (Jun 15)
  • Re: Export variables into snort startup process Brian (Jun 15)
• Brazilian users Rodrigo Ramos (Jun 14)
  • ACID Archive data Peggy Kam (Jun 14)
• Rule update question Nick Duda (Jun 14)
  • Re: Rule update question Andreas Östling (Jun 15)
    • Re: Rule update question Andreas Östling (Jun 23)
• Configuring PHP 4.3.6 on SuSE 9.0 Pro Tom Fulton (Jun 14)
  • <Possible follow-ups>
  • RE: Configuring PHP 4.3.6 on SuSE 9.0 Pro Corey Rock (Jun 18)
• Snort message: Unable to create an IPSet from any ... ? James Sinnamon (Jun 14)
  • snort output: Unable to create an IPSet from any ... ? James Sinnamon (Jun 14)
  • Re: Snort message: Unable to create an IPSet from any ... ? Paul Schmehl (Jun 14)
  • <Possible follow-ups>
  • Re: Snort message: Unable to create an IPSet from any ... ? James Sinnamon (Jun 14)
    • updating rules bonnie buwono (Jun 15)
      • Re: updating rules Andreas Östling (Jun 15)
• ACID error loading db abstraction library Tom Fulton (Jun 14)
  • Re: ACID error loading db abstraction library Paul Schmehl (Jun 15)
    • Barnyard And Snort bonnie buwono (Jun 16)
• Nothing written to logfiles James Sinnamon (Jun 15)
  • Re: Nothing written to logfiles Paul Schmehl (Jun 15)
    • Re: Nothing written to logfiles James Sinnamon (Jun 15)
• snort.conf and ruleset-update Nicolas Saurbier (Jun 15)
• SNMP missing community string attempt Alan Barnes (Jun 15)
• RE: Help please: libpcre.so.0: cannot open shared.. . Rowland, Krisa W ERDC-ITL-MS Contractor (Jun 15)
  • Message not available
    • RE: Help please: libpcre.so.0: cannot open shared.. . Matt Kettler (Jun 15)
      • Snort and Cacti Error "SNMP missing community string attempt" Alan Barnes (Jun 15)
• Snort on Crossbeam C30 Christopher.Lewis (Jun 15)
  • <Possible follow-ups>
  • RE: Snort on Crossbeam C30 Joshua Berry (Jun 15)
• Attempted Information Leak & Misc activity Laskowski (Jun 15)
• RE: Problems Upgrading Rowland, Krisa W ERDC-ITL-MS Contractor (Jun 15)
  • Re: Problems Upgrading sekure (Jun 15)
  • Message not available
    • RE: Problems Upgrading Matt Kettler (Jun 15)
      • Re: Problems Upgrading Kenneth Kron (Jun 15)
      • Re: Problems Upgrading Matt Kettler (Jun 16)
  • Re: Problems Upgrading Bamm Visscher (Jun 15)
• Help! Kim.Sassaman (Jun 15)
  • <Possible follow-ups>
  • RE: Help! David (Jun 16)
  • RE: Help! Kim.Sassaman (Jun 16)
• What is home net Aaron Russ (Jun 15)
  • Re: What is home net sekure (Jun 16)
  • <Possible follow-ups>
  • RE: What is home net Kim.Sassaman (Jun 16)
    • Kernel space Cédric BLIN (Jun 16)
      • Re: Kernel space Matt Kettler (Jun 16)
      • Re: Kernel space Michael Boman (Jun 16)
• NEWBIE: Snort Atkins, Dwane P (Jun 16)
  • <Possible follow-ups>
  • RE: NEWBIE: Snort Atkins, Dwane P (Jun 16)
• Snort for RHAS rel. 2.1AS (Pensacola)? Shaun T. Erickson (Jun 16)
• RE: [Snort-sigs] Holy false Positives Lance Boon (Jun 16)
• Ok, Ok - I know - http_inspect Rowland, Krisa W ERDC-ITL-MS Contractor (Jun 16)
  • RE: Ok, Ok - I know - http_inspect Jeff Dell (Jun 16)
  • <Possible follow-ups>
  • RE: Ok, Ok - I know - http_inspect Rowland, Krisa W ERDC-ITL-MS Contractor (Jun 16)
    • RE: Ok, Ok - I know - http_inspect Jeff Dell (Jun 16)
  • RE: Ok, Ok - I know - http_inspect Koski, Brian (Jun 16)
  • RE: Ok, Ok - I know - http_inspect SN ORT (Jun 17)
    • RE: Ok, Ok - I know - http_inspect Snortty (Jun 17)
      • Re: Ok, Ok - I know - http_inspect sekure (Jun 17)
      • Re: Ok, Ok - I know - http_inspect Snortty (Jun 18)
      • Re: Ok, Ok - I know - http_inspect sekure (Jun 18)
      • Re: Ok, Ok - I know - http_inspect Snortty (Jun 18)
      • Re: Ok, Ok - I know - http_inspect SN ORT (Jun 18)
      • Re: Ok, Ok - I know - http_inspect Chris Keladis (Jun 18)
      • Re: Ok, Ok - I know - http_inspect Jeff Kell (Jun 18)
      • Re: Ok, Ok - I know - http_inspect sekure (Jun 17)
      • Re: Ok, Ok - I know - http_inspect Snortty (Jun 17)
• multiple instances of snort service Gargac. Jeff (Jun 16)
• Output Plugin Jürgen Schinker (Jun 17)
  • RE: Output Plugin Jeff Dell (Jun 17)
  • Re: Output Plugin Alejandro Flores (Jun 18)
• Best Practices for external sensors jonasb (Jun 17)
  • Re: Best Practices for external sensors Todd_Pratt (Jun 17)
  • <Possible follow-ups>
  • Re: Best Practices for external sensors M. Morgan (Jun 17)
  • RE: Best Practices for external sensors Truax, Shawn (MBS) (Jun 18)
• Snort Management Console Atkins, Dwane P (Jun 17)
  • <Possible follow-ups>
  • RE: Snort Management Console Truax, Shawn (MBS) (Jun 18)
    • RE: Snort Management Console Eric Hines (Jun 18)
• Passive email archive Miles Stevenson (Jun 17)
  • Re: Passive email archive Brian (Jun 17)
• How can I recognize rules with high false positive rate? Ali Zand (Jun 17)
  • Re: How can I recognize rules with high false positive rate? sekure (Jun 17)
• How can I recognize Snort rules with high false positive rate? Ali Zand (Jun 17)
  • Re: How can I recognize Snort rules with high false positive rate? Keith W. McCammon (Jun 17)
    • Re: How can I recognize Snort rules with high false positive rate? Jason Haar (Jun 17)
      • Re: How can I recognize Snort rules with high false positive rate? Keith W. McCammon (Jun 17)
      • Re: Re: How can I recognize Snort rules with high false positive rate? Ali Zand (Jun 18)
• Acid not loggin Laura (Jun 17)
  • <Possible follow-ups>
  • RE: Acid not loggin Shawn Kottke (Jun 17)
  • RE: Acid not loggin Kim.Sassaman (Jun 17)
• RE: [Snort-sigs] signature doesn't match Joshua Berry (Jun 18)
• pacsec.jp/core04 Call For Papers Dragos Ruiu (Jun 18)
• Problems with snort -A Pat Smith (Jun 18)
  • Re: Problems with snort -A Josh Berry (Jun 21)
• IDS Policy Manager Documentation Uso (Jun 19)
  • RE: IDS Policy Manager Documentation Jeff Dell (Jun 19)
• Tap problem. Paul W Halliday (Jun 19)
  • Re: Tap problem. Frank Knobbe (Jun 19)
    • Re: Tap problem. Paul W Halliday (Jun 19)
• snortreport and jpgraph Patrick Marquetecken (Jun 20)
  • Re: snortreport and jpgraph Paul Schmehl (Jun 23)
• Snort 2.1.x support on Win32 Koski, Brian (Jun 21)
  • Re: Snort 2.1.x support on Win32 Rich Adamson (Jun 21)
  • <Possible follow-ups>
  • RE: Snort 2.1.x support on Win32 Rich Adamson (Jun 22)
• possible causes of source and destination ip from external network Annie Green (Jun 21)
  • Re: possible causes of source and destination ip from external network Keith W. McCammon (Jun 21)
• Is this a successful hack attempt?...How serious? Suggestions? Sanjay Arora (Jun 21)
  • Re: Is this a successful hack attempt?...How serious? Suggestions? sekure (Jun 21)
  • <Possible follow-ups>
  • Re: Is this a successful hack attempt?...How serious? Suggestions? Brian King (Jun 21)
• RE: possible causes of source and destination ip fr om external network Truax, Shawn (MBS) (Jun 21)
• RE: Blocking specific port or IP address Alina Lebrato (Jun 21)
  • Re: Blocking specific port or IP address sekure (Jun 21)
  • Re: Blocking specific port or IP address Eric Hines (Jun 21)
  • Re: Blocking specific port or IP address Steve Suppe (Jun 22)
• Thresholding enhancement? Rich Adamson (Jun 22)
• Barnyard not inserting into acid_* Rudi Starcevic (Jun 22)
  • Re: Barnyard not inserting into acid_* sekure (Jun 23)
    • Re: Barnyard not inserting into acid_* Rudi Starcevic (Jun 23)
  • <Possible follow-ups>
  • RE: Barnyard not inserting into acid_* VanBrecht, Jason (Jun 24)
    • Re: Barnyard not inserting into acid_* sekure (Jun 24)
    • Re: Barnyard not inserting into acid_* Rudi Starcevic (Jun 24)
• Snort compilation Daniel Walther (Jun 23)
• Log to pipe Daniel Walther (Jun 23)
• Alert file question Jason Fischer (Jun 23)
  • Re: Alert file question sekure (Jun 23)
  • <Possible follow-ups>
  • Re: Alert file question Jason Fischer (Jun 24)
• Send logs to Windows Event Log Karl-Heinz Schulz (Jun 23)
• Postgresql + Snort Wireless on WRT54g: DB timestamp errors Steffen Pfendtner (Jun 23)
• DC Snort Users Group - Meeting Tomorrow (6/24)! Keith W. McCammon (Jun 23)
• Network Behaviour Anomoly Detection crayola (Jun 23)
  • Re: Network Behaviour Anomoly Detection Jon Baer (Jun 23)
    • RE: Network Behaviour Anomoly Detection Michael Cunningham (Jun 23)
      • RE: RE: Network Behaviour Anomoly Detection Jerry Shenk (Jun 24)
      • Re: RE: Network Behaviour Anomoly Detection security (Jun 24)
      • Re: RE: Network Behaviour Anomoly Detection Martin Roesch (Jun 24)
      • Re: RE: Network Behaviour Anomoly Detection pieter claassen (Jun 26)
      • Re: RE: Network Behaviour Anomoly Detection security (Jun 30)
  • <Possible follow-ups>
  • RE: RE: Network Behaviour Anomoly Detection hugh_fraser (Jun 30)
• advice on content rule for outgoing email jeffs (Jun 23)
  • Re: advice on content rule for outgoing email Matt Kettler (Jun 24)
• BPF-Filter Maetzky, Steffen (Extern) (Jun 24)
  • Re: BPF-Filter Thomas Bechtold (Jun 24)
  • Re: BPF-Filter Edin Dizdarevic (Jun 24)
• IDS Policy Manager 1.4 Released Jeff Dell (Jun 24)
• RE: Snort-users digest, Vol 1 #4337 - 10 msgs Chet Patel (Jun 24)
• RE: [Snort-sigs] SID 2404, NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt Lance Boon (Jun 24)
• Suspicious Traffic ISP Toolz (Jun 24)
  • Re: Suspicious Traffic Matt Kettler (Jun 25)
• traffic detection Muhammad Reza (Jun 25)
• how to make a single unified syslog file ke chen (Jun 25)
• Logging local traffic Max Walshe (Jun 25)
• Logging traffic on Win2k loopback adaptor Max Walshe (Jun 25)
• help snort Razia Mir (Jun 25)
  • Re: help snort Martin Roesch (Jun 28)
• Another Barnyard Question Lance Boon (Jun 25)
  • Re: Another Barnyard Question Andrew R. Baker (Jun 25)
  • <Possible follow-ups>
  • RE: Another Barnyard Question Lance Boon (Jun 25)
• Snort invented by the NSA? Keith W. McCammon (Jun 25)
  • Re: Snort invented by the NSA? Frank Knobbe (Jun 25)
    • Re: Snort invented by the NSA? Martin Roesch (Jun 25)
• Multiple Subnets in sr net Devanathan, Balaji (Corporate, consultant) (Jun 25)
  • RE: Multiple Subnets in sr net Jeff Dell (Jun 25)
  • Re: Multiple Subnets in sr net Frank Knobbe (Jun 25)
  • <Possible follow-ups>
  • RE: Multiple Subnets in sr net Murray, Todd (Jun 25)
  • RE: Multiple Subnets in sr net Devanathan, Balaji (Corporate, consultant) (Jun 25)
    • RE: Multiple Subnets in sr net Jeff Dell (Jun 25)
      • RE: Multiple Subnets in sr net Frank Knobbe (Jun 25)
• FATAL ERROR in bad-traffic.rules Xantius (Jun 26)
  • RE: FATAL ERROR in bad-traffic.rules Mark E. Donaldson (Jun 26)
    • Re: FATAL ERROR in bad-traffic.rules Xantius (Jun 26)
    • Re: FATAL ERROR in bad-traffic.rules Martin Roesch (Jun 28)
  • <Possible follow-ups>
  • Re: FATAL ERROR in bad-traffic.rules Xantius (Jun 27)
• Snort max at 256 simultaneous TCP stream? Tom Fulton (Jun 26)
  • RE: Snort max at 256 simultaneous TCP stream? Tom Fulton (Jun 26)
    • Re: Snort max at 256 simultaneous TCP stream? Edin Dizdarevic (Jun 26)
  • Re: Snort max at 256 simultaneous TCP stream? Martin Roesch (Jun 28)
• snort not logging alerts Nicholas Bernstein (Jun 27)
  • Re: snort not logging alerts Xantius (Jun 27)
  • Re: snort not logging alerts Martin Roesch (Jun 29)
  • Re: snort not logging alerts Martin Roesch (Jun 29)
  • <Possible follow-ups>
  • Re: snort not logging alerts SN ORT (Jun 28)
• snort signature simulation tools praveen kundurthi (Jun 28)
  • Re: snort signature simulation tools security (Jun 28)
• Réf. : [Snort-users] snort signature simulation tools etienne . causse (Jun 28)
• Integretion Firewall Gustavo Gomes (Jun 28)
  • Re: Integretion Firewall Matt Kettler (Jun 28)
• snort-nessus-correlation: honeysuckle vs. ids alert verification Maetzky, Steffen (Extern) (Jun 28)
• [Snort-users] Réf. : [Snort-users] snort signature simulation tools snort-users-admin (Jun 28)
• uricontent and pcre Matthew Grandison (Jun 28)
  • Re: uricontent and pcre Keith W. McCammon (Jun 28)
• problem with the portscan-ignore preprocessor Murray, Todd (Jun 28)
  • <Possible follow-ups>
  • RE: problem with the portscan-ignore preprocessor Murray, Todd (Jun 28)
• Snort on an OpenBSD firewall Sean Brown (Jun 28)
  • Re: Snort on an OpenBSD firewall Dragos Ruiu (Jun 28)
    • Re: Snort on an OpenBSD firewall Sean Brown (Jun 28)
  • Re: Snort on an OpenBSD firewall Matt Kettler (Jun 28)
    • Re: Snort on an OpenBSD firewall Sean Brown (Jun 28)
• 2.1.3 and IPv6 Rowland, Krisa W ERDC-ITL-MS Contractor (Jun 28)
  • Message not available
    • Re: 2.1.3 and IPv6 Matt Kettler (Jun 28)
• Compiling Snort source code Hussein Osman (Jun 28)
• pls Un-subscribe ME Neeraj Jha (Jun 28)
• Request for advice Nicholas Bernstein (Jun 28)
  • Snort is a "niche player" Yaakov Yehudi (Jun 29)
    • Re: Snort is a "niche player" Keith W. McCammon (Jun 29)
      • Re: Snort is a "niche player" Frank Knobbe (Jun 29)
      • Re: Snort is a "niche player" twig les (Jun 29)
    • Re: Snort is a "niche player" Guillaume Arcas (Jun 29)
      • Re: Snort is a "niche player" James Riden (Jun 29)
      • RE: Snort is a "niche player" Yaakov Yehudi (Jun 29)
      • RE: Snort is a "niche player" Darren Webb (Jun 29)
  • Message not available
    • Message not available
      • Re: Request for advice Sean Brown (Jun 29)
      • Re: Request for advice Sean Brown (Jun 29)
      • Re: Request for advice sekure (Jun 30)
• Snort CVS Moving to cvs.snort.org Martin Roesch (Jun 29)
  • Re: [Snort-devel] Snort CVS Moving to cvs.snort.org Frank Knobbe (Jun 29)
  • Re: Snort CVS Moving to cvs.snort.org security (Jun 30)
• Réf. : [Snort-users] Snort is a "niche player" etienne . causse (Jun 29)
  • Re: Snort is a "niche player" Martin Roesch (Jun 29)
    • Re: Snort is a "niche player" Michael Sconzo (Jun 29)
      • Installing Snort As Service Jospeh (Jun 29)
    • RE: Snort is a "niche player" Yaakov Yehudi (Jun 29)
  • RE: Réf. : [Snort-users] Snort is a "niche player" Yaakov Yehudi (Jun 29)
• Snort 2.2.0-RC1 available Jeremy Hewlett (Jun 29)
• Sguil-0.5.0 Released Bamm Visscher (Jun 29)
• Thresholding... Tobias Rice (Jun 29)
• Re: Installing Snort As Service Jospeh (Jun 29)
  • RE: Re: Installing Snort As Service Michael Steele (Jun 29)
• RE: Snort is a Yaakov Yehudi (Jun 29)
• Thresholding problem: ERROR: *** threshold: gen_id / *** Invalid integer input: 0 Uso (Jun 30)
  • Re: Thresholding problem: ERROR: *** threshold: gen_id / *** Invalid integer input: 0 Chris Reid (Jun 30)
    • Re: Thresholding problem: ERROR: *** threshold: gen_id / *** Invalid integer input: 0 Rich Adamson (Jun 30)
    • Re: Thresholding problem: ERROR: *** threshold: gen_id / *** Invalid integer input: 0 Rich Adamson (Jun 30)
    • Threshold rule syntax? Rich Adamson (Jun 30)
      • Threshold Bug - 2.2.0-RC1 Rich Adamson (Jun 30)
• RE: Snort is a "niche player" Bob Walder (Jun 30)
  • <Possible follow-ups>
  • RE: Snort is a "niche player" Bob Walder (Jun 30)
  • RE: Snort is a "niche player" Bob Walder (Jun 30)
    • RE: Snort is a "niche player" Paul Schmehl (Jun 30)
• Missing events sekure (Jun 30)
• Problem Starting Snort Felkins, Michael R. (Jun 30)
  • Re: Problem Starting Snort sekure (Jun 30)
  • <Possible follow-ups>
  • RE: Problem Starting Snort Lance Boon (Jun 30)
  • RE: Problem Starting Snort Michael . R . Felkins (Jun 30)
• Test: No reply needed Corey Rock (Jun 30)
• Snort wireless Daniel Walther (Jun 30)

Previous period

Next period