Snort: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

657 messages starting Oct 02 11 and ending Dec 30 11
Date index | Thread index | Author index

• Re: how to disable an so_rule JJ Cummings (Oct 02)
• Re: [Snort-Users] Re: Some questions about strem5 preprocessor Matt Watchinski (Oct 02)
  • Re: [Snort-Users] Re: Some questions about strem5 preprocessor carlopmart (Oct 03)
• Layer2resets functionality in snort 2.9 snort user (Oct 03)
  • Re: Layer2resets functionality in snort 2.9 snort user (Oct 03)
• Re: Installing only so_rules with pulledpork JJC (Oct 03)
  • Re: Installing only so_rules with pulledpork JJC (Oct 03)
• Avoid logging sensitive data James Lay (Oct 03)
  • Re: Avoid logging sensitive data Adam Hogan (Oct 04)
    • Re: Avoid logging sensitive data James Lay (Oct 04)
• segfault in stream5 Brett Edgar (Oct 03)
  • Re: segfault in stream5 snort user (Oct 03)
    • Re: segfault in stream5 Brett Edgar (Oct 04)
      • Re: segfault in stream5 Brett Edgar (Oct 04)
      • Re: segfault in stream5 Joel Esler (Oct 04)
      • Re: segfault in stream5 snort user (Oct 04)
      • Re: segfault in stream5 snort user (Oct 04)
      • Re: segfault in stream5 Russ Combs (Oct 05)
• No packets are captured on Debian6 in mode 1 or 2 Nelo Belda (Oct 04)
  • Re: No packets are captured on Debian6 in mode 1 or 2 Nelo Belda (Oct 04)
• detect SSTP tunnel rmkml (Oct 04)
  • Re: detect SSTP tunnel Joel Esler (Oct 05)
    • Re: detect SSTP tunnel rmkml (Oct 05)
• Logging: alert vs drop with PulledPork using VRT & ET rules NA (Oct 04)
  • Re: Logging: alert vs drop with PulledPork using VRT & ET rules JJ Cummings (Oct 04)
    • Re: Logging: alert vs drop with PulledPork using VRT & ET rules NA (Oct 05)
      • Re: Logging: alert vs drop with PulledPork using VRT & ET rules JJC (Oct 05)
• How to check the trace file by using snort rule Qinwen Hu (Oct 04)
  • Message not available
    • Re: How to check the trace file by using snort rule Kevin Ross (Oct 04)
• Sourcefire VRT Certified Snort Rules Update 2011-10-04 Research (Oct 04)
• Fwd: segfault in Snort 2.9.1 on reload Dave Corsello (Oct 04)
• Rule 13573 question Lay, James (Oct 05)
  • Re: Rule 13573 question Alex Kirk (Oct 05)
• Lotsa 13974 Lay, James (Oct 05)
  • Re: Lotsa 13974 Alex Kirk (Oct 05)
    • Re: Lotsa 13974 Lay, James (Oct 05)
      • Re: Lotsa 13974 Alex Kirk (Oct 05)
• Timestamp Format in alert_fast Mode Jason D. McCormick (Oct 05)
  • Re: Timestamp Format in alert_fast Mode Russ Combs (Oct 05)
    • Re: Timestamp Format in alert_fast Mode Jason D. McCormick (Oct 05)
• BOTNET-CNC Dropper Win32.Cefyns.A outbound connection triggered by domain parking Jefferson, Shawn (Oct 05)
  • Re: BOTNET-CNC Dropper Win32.Cefyns.A outbound connection triggered by domain parking NA (Oct 05)
    • Re: BOTNET-CNC Dropper Win32.Cefyns.A outbound connection triggered by domain parking Jason Wallace (Oct 05)
      • Re: BOTNET-CNC Dropper Win32.Cefyns.A outbound connection triggered by domain parking Joel Esler (Oct 05)
• Cannot access securixlive.com Marty Pikor (Oct 06)
  • Re: Cannot access securixlive.com Paul Halliday (Oct 06)
• Re: [Snort-Users] Snort.org Blog: Snort 2.9.1 HTTP and SMTP logging features Jason (Oct 06)
• Re: [Snort-Users] Snort.org Blog: Snort 2.9.1 HTTP and SMTP logging features Jason (Oct 06)
• Re: Snort.org Blog: Snort 2.9.1 HTTP and SMTP logging features Jason Haar (Oct 06)
• Snort Wget Failure (can't resolve www.snort.org) Todd Booth (Oct 06)
  • Re: Snort Wget Failure (can't resolve www.snort.org) Joel Esler (Oct 06)
  • Re: Snort Wget Failure (can't resolve www.snort.org) Carney, Megan (Oct 06)
    • Re: Snort Wget Failure (can't resolve www.snort.org) Joel Esler (Oct 06)
      • Re: Snort Wget Failure (can't resolve www.snort.org) Negin Nickparsa (Oct 06)
      • Re: Snort Wget Failure (can't resolve www.snort.org) Brandon Hall (Oct 06)
• snort 2.9.1 segfault and general protection error Salvador, Mario (Oct 06)
  • Re: snort 2.9.1 segfault and general protection error carlopmart (Oct 06)
  • Re: snort 2.9.1 segfault and general protection error Joel Esler (Oct 06)
  • <Possible follow-ups>
  • snort 2.9.1 segfault and general protection error Salvador, Mario (Oct 06)
• Understanding byte_test Lay, James (Oct 06)
  • Re: Understanding byte_test rmkml (Oct 06)
• Sourcefire VRT Certified Snort Rules Update 2011-10-06 Research (Oct 06)
• Re: Snort Wget Failure (can't resolve > www.snort.org) Willst Mail (Oct 06)
  • Re: Snort Wget Failure (can't resolve > www.snort.org) Joel Esler (Oct 06)
  • Re: Snort Wget Failure (can't resolve > www.snort.org) JJ Cummings (Oct 06)
• Snort 2.9.1 Now Available Snort Releases (Oct 06)
  • Snort 2.9.1.1 Now Available Snort Releases (Oct 06)
  • Snort 2.9.1.2 Now Available Snort Releases (Oct 20)
    • Re: Snort 2.9.1.2 Now Available Eoin Miller (Oct 20)
      • Re: Snort 2.9.1.2 Now Available Ryan Jordan (Oct 20)
      • Re: Snort 2.9.1.2 Now Available Ryan Jordan (Oct 20)
• Snort 2.9.1.1 Now Available Snort Releases (Oct 06)
  • Snort 2.9.1.1 ERROR - SF_REPUTATION Edward Fjellskål (Oct 07)
    • Re: Snort 2.9.1.1 ERROR - SF_REPUTATION Russ Combs (Oct 07)
      • Re: Snort 2.9.1.1 ERROR - SF_REPUTATION Edward Fjellskål (Oct 07)
• [BUG][Stream5]: SIGSEGV in Stream5 TCP, TcpSessionCleanup at snort_stream5_tcp.c:4624 Joshua.Kinard (Oct 06)
  • Re: [BUG][Stream5]: SIGSEGV in Stream5 TCP, TcpSessionCleanup at snort_stream5_tcp.c:4624 Russ Combs (Oct 07)
    • Re: [BUG][Stream5]: SIGSEGV in Stream5 TCP, TcpSessionCleanup at snort_stream5_tcp.c:4624 Russ Combs (Oct 07)
      • Re: [BUG][Stream5]: SIGSEGV in Stream5 TCP, TcpSessionCleanup at snort_stream5_tcp.c:4624 Joshua.Kinard (Oct 07)
      • Re: [BUG][Stream5]: SIGSEGV in Stream5 TCP, TcpSessionCleanup at snort_stream5_tcp.c:4624 Russ Combs (Oct 08)
• 'only_stream' (and other alternate decode buffers) do not write out data to the logs Joshua.Kinard (Oct 07)
  • Re: 'only_stream' (and other alternate decode buffers) do not write out data to the logs Joel Esler (Oct 07)
    • Re: 'only_stream' (and other alternate decode buffers) do not write out data to the logs Joshua.Kinard (Oct 07)
      • Re: 'only_stream' (and other alternate decode buffers) do not write out data to the logs Jason Brvenik (Oct 12)
      • Re: 'only_stream' (and other alternate decode buffers) do not write out data to the logs Joshua.Kinard (Oct 07)
      • Re: 'only_stream' (and other alternate decode buffers) do not write out data to the logs Steven Sturges (Oct 08)
      • Re: 'only_stream' (and other alternate decode buffers) do not write out data to the logs Joel Esler (Oct 08)
      • Re: 'only_stream' (and other alternate decode buffers) do not write out data to the logs Joshua.Kinard (Oct 12)
      • Re: 'only_stream' (and other alternate decode buffers) do not write out data to the logs Jason Brvenik (Oct 12)
• gen-msg.map duplicate entries Eric Olsen (Oct 07)
  • Re: gen-msg.map duplicate entries Ryan Jordan (Oct 07)
• Compiling with --enable-sourcefire = ??? Eoin Miller (Oct 07)
  • Re: Compiling with --enable-sourcefire = ??? Joel Esler (Oct 07)
  • Re: Compiling with --enable-sourcefire = ??? Russ Combs (Oct 07)
• Wireshnork - A snort plugin for Wireshark - Volunteers needed Guillaume Arcas (Oct 07)
  • Re: Wireshnork - A snort plugin for Wireshark - Volunteers needed Pablo (Oct 07)
    • Re: Wireshnork - A snort plugin for Wireshark - Volunteers needed Guillaume Arcas (Oct 07)
• Re: Problem with using 2 sensors Mike Boeckeler (Oct 07)
  • Re: Problem with using 2 sensors James Lay (Oct 07)
  • Re: Problem with using 2 sensors Kevin Ross (Oct 08)
    • Re: Problem with using 2 sensors Mike Boeckeler (Oct 08)
      • Re: Problem with using 2 sensors James Lay (Oct 08)
      • Re: Problem with using 2 sensors Joel Esler (Oct 08)
      • Re: Problem with using 2 sensors Kevin Ross (Oct 08)
• Snort.conf issues Qinwen Hu (Oct 07)
  • Re: Snort.conf issues Russ Combs (Oct 08)
• clarification between barnyard2 and snort MLP SCADA (Oct 08)
  • Re: clarification between barnyard2 and snort Joel Esler (Oct 08)
• PCRE Performance vincent (Oct 10)
  • Re: PCRE Performance waldo kitty (Oct 10)
  • Re: PCRE Performance Jamie Riden (Oct 10)
    • Re: PCRE Performance vincent (Oct 10)
      • Re: PCRE Performance Jason Wallace (Oct 10)
      • Re: PCRE Performance vincent (Oct 10)
• A bunch of FP's with Skype? (ET rules) NA (Oct 10)
  • Re: A bunch of FP's with Skype? (ET rules) Jeff Kell (Oct 10)
    • Re: A bunch of FP's with Skype? (ET rules) Matthew Jonkman (Oct 14)
• Sourcefire VRT Certified Snort Rules Update 2011-10-11 Research (Oct 11)
• noise on new http_inspect 120:8 John York (Oct 11)
  • Re: noise on new http_inspect 120:8 Joel Esler (Oct 11)
• Re: [PATCH][RESEND]: Use uint8_t for protocol in some Stream5functions Russ Combs (Oct 11)
• Re: [Snort-Users] help me about snortsp 3.0.b3 Kevin Ross (Oct 12)
  • Re: [Snort-Users] help me about snortsp 3.0.b3 Joel Esler (Oct 12)
• Is it dangerous to tweak http_inspect defaults Mike Lococo (Oct 12)
  • Re: Is it dangerous to tweak http_inspect defaults Joel Esler (Oct 12)
    • Re: Is it dangerous to tweak http_inspect defaults Mike Lococo (Oct 12)
      • Re: Is it dangerous to tweak http_inspect defaults Joel Esler (Oct 12)
• Running snort 2.9.1.1 on a host with low memory carlopmart (Oct 12)
• Snort Rule Format Example motahareh dehghan chachkamy (Oct 12)
  • Re: Snort Rule Format Example Joel Esler (Oct 12)
    • Re: Snort Rule Format Example JJ Cummings (Oct 12)
      • Re: Snort Rule Format Example Martin Holste (Oct 12)
      • Re: Snort Rule Format Example Joel Esler (Oct 13)
• snort 2.9.1.1 Build 83 packages for RHEL5.x and RHEL6.x vincent (Oct 13)
• Faulting application snort.exe eltra1n (Oct 13)
• Snortreport remote command execution vuln Lay, James (Oct 13)
• Negated IP Ranges Brandon Phelps (Oct 13)
  • Re: Negated IP Ranges Joel Esler (Oct 14)
• Need to find running snort rule version ccie 6862 (Oct 13)
  • Re: Need to find running snort rule version Nigel Houghton (Oct 13)
    • Re: Need to find running snort rule version James Lay (Oct 13)
• Odd Byte Tests in BLACKLIST DNS request for known malware domain rules Christopher Granger (Oct 13)
  • Re: Odd Byte Tests in BLACKLIST DNS request for known malware domain rules Christopher Granger (Oct 13)
    • Re: Odd Byte Tests in BLACKLIST DNS request for known malware domain rules Christopher Granger (Oct 13)
      • Re: Odd Byte Tests in BLACKLIST DNS request for known malware domain rules Christopher Granger (Oct 14)
      • Re: Odd Byte Tests in BLACKLIST DNS request for known malware domain rules Joel Esler (Oct 15)
• Bug - Segmentation fault with empty HOME_NET elof (Oct 14)
• EOL Policy Out of Date Mike Lococo (Oct 14)
  • Re: EOL Policy Out of Date Joel Esler (Oct 14)
    • Re: EOL Policy Out of Date Mike Lococo (Oct 14)
• Base not reporting "Portscan Traffic" Mike Boeckeler (Oct 16)
  • Re: Base not reporting "Portscan Traffic" Mike Boeckeler (Oct 20)
• Potential Improvements related to PCRE library and usage. snort user (Oct 17)
  • Re: Potential Improvements related to PCRE library and usage. Joel Esler (Oct 17)
• Sourcefire VRT Certified Snort Rules Update 2011-10-18 Research (Oct 18)
• The VRT is looking for more good test environments. Joel Esler (Oct 18)
• afpacket with three interfaces carlopmart (Oct 18)
  • Re: afpacket with three interfaces Michael Altizer (Oct 18)
    • Re: afpacket with three interfaces Jason Haar (Oct 18)
      • Re: afpacket with three interfaces carlopmart (Oct 19)
• High PatMatch eltra1n (Oct 18)
  • Re: High PatMatch Joel Esler (Oct 18)
  • Re: High PatMatch rmkml (Oct 19)
• missing pcaps for alerts John Ives (Oct 18)
  • Re: missing pcaps for alerts Joel Esler (Oct 18)
    • Re: missing pcaps for alerts John Ives (Oct 18)
      • Re: missing pcaps for alerts Joel Esler (Oct 19)
      • Re: missing pcaps for alerts John Ives (Oct 19)
  • Re: missing pcaps for alerts Eoin Miller (Oct 20)
    • Re: missing pcaps for alerts Joel Esler (Oct 20)
      • Re: missing pcaps for alerts John Ives (Oct 25)
      • Re: missing pcaps for alerts Joel Esler (Oct 25)
• Snort 2.9.1.1 sfportscan syntax changed? Cees (Oct 19)
  • Re: Snort 2.9.1.1 sfportscan syntax changed? Joel Esler (Oct 19)
    • Re: Snort 2.9.1.1 sfportscan syntax changed? Cees (Oct 20)
• Weird double logging problem Peter Bates (Oct 19)
  • Re: Weird double logging problem Jason Wallace (Oct 19)
    • Re: Weird double logging problem Peter Bates (Oct 19)
      • Re: Weird double logging problem Peter Bates (Oct 19)
      • Re: Weird double logging problem Joel Esler (Oct 19)
• [HITB-Announce] HITB Magazine Issue #7 HITB Magazine (Oct 19)
• Compact Snort Configuration Pratik Kumawat (Oct 20)
  • Re: Compact Snort Configuration Joel Esler (Oct 20)
• Rules not hit on 2.9.1.1 sensor Peter Bates (Oct 20)
  • Re: Rules not hit on 2.9.1.1 sensor Peter Bates (Oct 20)
    • Re: Rules not hit on 2.9.1.1 sensor Martin Holste (Oct 20)
      • Re: Rules not hit on 2.9.1.1 sensor Peter Bates (Oct 20)
      • Re: Rules not hit on 2.9.1.1 sensor Martin Holste (Oct 20)
      • Re: Rules not hit on 2.9.1.1 sensor Peter Bates (Oct 20)
      • Re: Rules not hit on 2.9.1.1 sensor Joel Esler (Oct 20)
      • Re: Rules not hit on 2.9.1.1 sensor Martin Holste (Oct 20)
      • Re: Rules not hit on 2.9.1.1 sensor Peter Bates (Oct 21)
• Re: [Snort-Users] HELP_SNORT Joel Esler (Oct 20)
  • Re: [Snort-Users] HELP_SNORT waldo kitty (Oct 20)
    • Re: [Snort-Users] HELP_SNORT Joel Esler (Oct 20)
      • Re: [Snort-Users] HELP_SNORT JJ Cummings (Oct 20)
      • Re: [Snort-Users] HELP_SNORT Joel Esler (Oct 20)
• snortsam on 2.9.1? Jeff Kell (Oct 20)
  • Re: snortsam on 2.9.1? Luis Daniel Lucio Quiroz (Oct 20)
• Sourcefire VRT Certified Snort Rules Update 2011-10-20 Research (Oct 20)
• error compiling daq-0.5 naurin (Oct 20)
  • Re: error compiling daq-0.5 Joel Esler (Oct 21)
• SID 17458 matching EICAR rather than intended vuln. Jeff Jarmoc (Oct 21)
  • Re: SID 17458 matching EICAR rather than intended vuln. Joel Esler (Oct 21)
• file_data pointer Eoin Miller (Oct 21)
  • Re: file_data pointer Joel Esler (Oct 21)
• SERVER ADDRESSES Pratik Kumawat (Oct 22)
  • Re: SERVER ADDRESSES Joel Esler (Oct 23)
• Re: HI Joel Esler (Oct 23)
• snort 2.9.1.2 uild 84 packages for RHEL5.x and RHEL6.x vincent (Oct 24)
• sid:19559 BAD-TRAFFIC SSH brute force login attempt False Positive Thibaut PIRONNEAU (Oct 25)
  • Re: sid:19559 BAD-TRAFFIC SSH brute force login attempt False Positive Alex Kirk (Oct 25)
• Fine tuning portscan Lay, James (Oct 25)
  • Re: Fine tuning portscan Joel Esler (Oct 25)
  • Re: Fine tuning portscan JJC (Oct 25)
    • Re: Fine tuning portscan Lay, James (Oct 25)
• Snort 2.9.1.2 unknown preprocessor Document Retention (Oct 25)
  • Re: Snort 2.9.1.2 unknown preprocessor Joel Esler (Oct 25)
• (no subject) cnuddep (Oct 25)
  • <Possible follow-ups>
  • (no subject) Daugherty Bryan (Dec 04)
    • Re: (no subject) Joel Esler (Dec 05)
• Re: [Snort-Users] BAD-TRAFFIC small or zero-sized tcp window Kevin Ross (Oct 26)
  • Message not available
    • Re: [Snort-Users] BAD-TRAFFIC small or zero-sized tcp window Kevin Ross (Oct 26)
• 2.9.1.2 rebuild problems John York (Oct 26)
• Email Tracking Code Signature Simeon Bush (Oct 27)
  • <Possible follow-ups>
  • Re: Email Tracking Code Signature Lay, James (Oct 31)
• Sourcefire VRT Certified Snort Rules Update 2011-10-27 Research (Oct 27)
• Snort 2.9.2 Beta Now Available Snort Releases (Oct 28)
  • <Possible follow-ups>
  • Snort 2.9.2 Beta Now Available Snort Releases (Oct 28)
• Host attribute table validation / usage Enrico Papi (Oct 29)
  • Re: Host attribute table validation / usage Joel Esler (Oct 31)
• Create error "daq_nfq.la" on debian6/ubuntu11.10 64bit Pascal Holthaus (Oct 29)
  • Re: Create error "daq_nfq.la" on debian6/ubuntu11.10 64bit Martin Holste (Oct 30)
    • Re: Create error "daq_nfq.la" on debian6/ubuntu11.10 64bit Russ Combs (Oct 31)
• Ubuntu 11.04 / 10 rulesset Marcin Nawrocki (Oct 31)
  • Re: Ubuntu 11.04 / 10 rulesset Mike Lococo (Oct 31)
    • Re: Ubuntu 11.04 / 10 rulesset Joel Esler (Oct 31)
      • Re: Ubuntu 11.04 / 10 rulesset Nick Moore (Oct 31)
      • Re: Ubuntu 11.04 / 10 rulesset Mike Lococo (Oct 31)
      • Re: Ubuntu 11.04 / 10 rulesset Joel Esler (Oct 31)
    • Re: Ubuntu 11.04 / 10 rulesset Randal T. Rioux (Nov 01)
      • Re: Ubuntu 11.04 / 10 rulesset Joel Esler (Nov 01)
• Fwd: [snorby] VRT/ET/Local rule look-ups by assigned sid range. (#138) Will Metcalf (Nov 01)
  • Re: [snorby] VRT/ET/Local rule look-ups by assigned sid range. (#138) Joel Esler (Nov 01)
  • Re: Fwd: [snorby] VRT/ET/Local rule look-ups by assigned sid range. (#138) JJC (Nov 01)
• Access to the flow's SYN and SYN-ACK packet ndritsos (Nov 02)
• Capturing packets with daemonlogger using GMT as a timestamp carlopmart (Nov 02)
  • Re: Capturing packets with daemonlogger using GMT as a timestamp Richard Bejtlich (Nov 04)
• Sourcefire VRT Certified Snort Rules Update 2011-11-02 Research (Nov 02)
• VRT: Say Hello to the file-identify category Joel Esler (Nov 02)
• Detecting TCP session without data after three-way handshake Willst Mail (Nov 02)
  • Re: Detecting TCP session without data after three-way handshake Edward Fjellskål (Nov 03)
  • Re: Detecting TCP session without data after three-wayhandshake Jason Haar (Nov 03)
    • Re: Detecting TCP session without data after three-wayhandshake Giles Coochey (Nov 04)
    • Re: Detecting TCP session without data after three-wayhandshake Martin Holste (Nov 04)
    • Re: Detecting TCP session without data after three-wayhandshake Seth Hall (Nov 04)
• CrossCompiling Snort Pratik Kumawat (Nov 03)
• snort error Pawan Lal (Nov 03)
  • <Possible follow-ups>
  • snort error Pawan Lal (Nov 21)
• Context: Malware Blog Post on Dark Comet RAT with Snort Signatures Context IS - Disclosure (Nov 03)
  • Re: Context: Malware Blog Post on Dark Comet RAT with Snort Signatures Bad Horse (Nov 03)
  • Re: Context: Malware Blog Post on Dark Comet RAT with Snort Signatures Martin Holste (Nov 03)
    • Re: Context: Malware Blog Post on Dark Comet RAT with Snort Signatures JJ Cummings (Nov 03)
    • Re: Context: Malware Blog Post on Dark Comet RAT with Snort Signatures Bad Horse (Nov 03)
      • Re: Context: Malware Blog Post on Dark Comet RAT with Snort Signatures Context IS - Disclosure (Nov 03)
      • Re: Context: Malware Blog Post on Dark Comet RAT with Snort Signatures Jamie Riden (Nov 03)
      • Re: Context: Malware Blog Post on Dark Comet RAT with Snort Signatures Martin Holste (Nov 03)
• Rule Lay, James (Nov 04)
  • Re: Rule rmkml (Nov 04)
  • Re: Rule Joel Esler (Nov 04)
    • Re: Rule Lay, James (Nov 04)
• New Rules Heads Up Gibson, Nathan J. (HSC) (Nov 04)
  • Re: New Rules Heads Up Joel Esler (Nov 04)
    • Re: New Rules Heads Up Lay, James (Nov 04)
  • Re: New Rules Heads Up Joel Esler (Nov 04)
  • <Possible follow-ups>
  • Re: New Rules Heads Up Gregory Zill (Nov 04)
    • Re: New Rules Heads Up Joel Esler (Nov 04)
• Sourcefire VRT Certified Snort Rules Update 2011-11-04 Research (Nov 04)
• Several problems with snort 2.9.1.2 under OpenBSD 5.0 carlopmart (Nov 05)
  • Re: [Snort-Users] Several problems with snort 2.9.1.2 under OpenBSD 5.0 Joel Esler (Nov 05)
  • Re: [Snort-Users] Several problems with snort 2.9.1.2 under OpenBSD 5.0 Joel Esler (Nov 05)
    • Re: Several problems with snort 2.9.1.2 under OpenBSD 5.0 Randal T. Rioux (Nov 05)
• Sourcefire VRT Certified Snort Rules Update 2011-11-07 Research (Nov 07)
• Question on http_inspect Owen Blandford (Nov 08)
  • <Possible follow-ups>
  • Re: Question on http_inspect Lay, James (Nov 08)
• Sourcefire VRT Certified Snort Rules Update 2011-11-08 Research (Nov 08)
• test Paul Wong (Nov 08)
• Stream5 and Frag3 preprocessors Pablo Cantos (Nov 09)
• Slow Start Times (5 minutes +) Eoin Miller (Nov 09)
  • Re: Slow Start Times (5 minutes +) JJC (Nov 10)
    • Re: Slow Start Times (5 minutes +) Eoin Miller (Nov 10)
• IDS Mode - hierarchical order Marcin Nawrocki (Nov 10)
• Regarding snort.conf HOME_NET and EXTERNAL_NET Brandon Phelps (Nov 10)
  • Re: Regarding snort.conf HOME_NET and EXTERNAL_NET Adam Hogan (Nov 11)
• Sourcefire VRT Certified Snort Rules Update 2011-11-10 Research (Nov 10)
• Pulledpork error Peter Bates (Nov 11)
• Data link type error Qinwen Hu (Nov 11)
• Looking for an alternative to BASE Michael Steele (Nov 11)
  • Re: Looking for an alternative to BASE carlopmart (Nov 11)
    • Message not available
      • Message not available
      • Re: Looking for an alternative to BASE Michael Steele (Nov 12)
      • Re: Looking for an alternative to BASE carlopmart (Nov 12)
  • Re: Looking for an alternative to BASE Richard Bejtlich (Nov 11)
    • Re: Looking for an alternative to BASE Michael Steele (Nov 11)
      • Message not available
      • Re: Looking for an alternative to BASE Michael Steele (Nov 12)
      • Re: Looking for an alternative to BASE Dewhirst, Rob (Nov 12)
      • Re: Looking for an alternative to BASE James Lay (Nov 12)
      • Re: Looking for an alternative to BASE Michael Steele (Nov 12)
• snort not logging full output to syslog Rajeev Sinha (Nov 13)
  • Re: snort not logging full output to syslog Joel Esler (Nov 13)
    • Re: snort not logging full output to syslog Rajeev Sinha (Nov 13)
• [PATCH] Add non-IP layer 3 detection via new 'ether_type' keyword and 'eth' protocol Joshua Kinard (Nov 13)
  • Re: [PATCH] Add non-IP layer 3 detection via new 'ether_type' keyword and 'eth' protocol Joshua Kinard (Nov 20)
    • Re: [PATCH] Add non-IP layer 3 detection via new 'ether_type' keyword and 'eth' protocol Joel Esler (Nov 28)
  • Re: [PATCH] Add non-IP layer 3 detection via new 'ether_type' keyword and 'eth' protocol Joshua Kinard (Dec 26)
• Snort too verbose Rick Chisholm (Nov 14)
  • Re: Snort too verbose Joel Esler (Nov 14)
    • Re: Snort too verbose Rick Chisholm (Nov 14)
      • Re: Snort too verbose Joel Esler (Nov 14)
      • Re: Snort too verbose Rick Chisholm (Nov 14)
      • Re: Snort too verbose Joel Esler (Nov 14)
• undescribed alerts Rick Chisholm (Nov 14)
  • Re: undescribed alerts JJC (Nov 14)
  • Re: undescribed alerts Scott Runnels (Nov 14)
    • Re: undescribed alerts JJC (Nov 14)
      • Re: undescribed alerts Rick Chisholm (Nov 14)
• Question for the Guru's John Liss (Nov 14)
  • Re: Question for the Guru's Joel Esler (Nov 14)
  • Re: Question for the Guru's carlopmart (Nov 14)
    • Re: Question for the Guru's NA (Nov 14)
      • Re: Question for the Guru's carlopmart (Nov 14)
      • Re: Question for the Guru's John Liss (Nov 14)
      • Re: Question for the Guru's NA (Nov 14)
      • Re: Question for the Guru's John Liss (Nov 14)
      • Re: Question for the Guru's John Liss (Nov 16)
      • Re: Question for the Guru's Joel Esler (Nov 17)
• A question about disable sids with pulledpork carlopmart (Nov 14)
  • Re: A question about disable sids with pulledpork JJ Cummings (Nov 14)
    • Re: A question about disable sids with pulledpork carlopmart (Nov 14)
      • Re: A question about disable sids with pulledpork Lay, James (Nov 14)
      • Re: A question about disable sids with pulledpork carlopmart (Nov 14)
      • Re: A question about disable sids with pulledpork JJ Cummings (Nov 14)
      • Re: A question about disable sids with pulledpork carlopmart (Nov 15)
• how to configure dual-nic-setup-using-portscan Pawan Lal (Nov 14)
  • Re: how to configure dual-nic-setup-using-portscan Nick Moore (Nov 16)
• Dynamic preprocessor or plugins accessing sonrt configurations snort user (Nov 14)
• Snort Inline mode!! Pratik Kumawat (Nov 14)
  • Re: Snort Inline mode!! NA (Nov 15)
    • Message not available
      • Re: Snort Inline mode!! NA (Nov 16)
• Sourcefire VRT Certified Snort Rules Update 2011-11-15 Research (Nov 15)
• ssp_ssl preprocessor vincent (Nov 15)
• SSL DoS Signatures Gibson, Nathan J. (HSC) (Nov 15)
• snort wireless card "ERROR: Can't start DAQ (-1) - ê!î☺!" codeforfun (Nov 15)
  • Re: [Snort-users] snort wireless card "ERROR: Can't start DAQ (-1) - ê!î???!" acv (Nov 15)
    • Re: snort wireless card "ERROR: Can't start DAQ (-1) - ê!î???!" codeforfun (Nov 15)
    • Re: snort wireless card "ERROR: Can't start DAQ (-1) - ê!î???!" codeforfun (Nov 21)
    • how to update snort codeforfun (Nov 21)
      • Re: how to update snort Joel Esler (Nov 21)
      • Re: how to update snort codeforfun (Nov 21)
• Snort: Cannot decode data link type Qinwen Hu (Nov 15)
  • <Possible follow-ups>
  • Snort: cannot decode data link type Qinwen Hu (Nov 15)
• New IDS best practise Michael Maymann (Nov 16)
  • Re: New IDS best practise Mark W. Jeanmougin (Nov 17)
  • Re: New IDS best practise Kevin Ross (Nov 17)
    • Re: New IDS best practise Martin Holste (Nov 17)
      • Re: New IDS best practise Joel Esler (Nov 17)
      • Re: New IDS best practise Martin Holste (Nov 17)
      • Re: New IDS best practise beenph (Nov 17)
      • Re: New IDS best practise Martin Holste (Nov 17)
      • Re: New IDS best practise beenph (Nov 17)
      • Re: New IDS best practise Dustin Webber (Nov 17)
• HTTP over 443/TCP Eoin Miller (Nov 16)
  • Re: HTTP over 443/TCP Joel Esler (Nov 29)
• any rule for BIND 9 Resolver DoS? Jason Haar (Nov 16)
  • Re: any rule for BIND 9 Resolver DoS? Joel Esler (Nov 17)
• Detecting last bind vulnerability? rmkml (Nov 17)
  • Re: Detecting last bind vulnerability? Lay, James (Nov 17)
• Snort on OpenBSD 5.0 amd64 ML mail (Nov 18)
  • Re: Snort on OpenBSD 5.0 amd64 carlopmart (Nov 18)
    • Re: Snort on OpenBSD 5.0 amd64 ML mail (Nov 18)
      • Re: Snort on OpenBSD 5.0 amd64 carlopmart (Nov 18)
• Displaying few packets before a matched packet Arvind S Raj (Nov 18)
  • Re: Displaying few packets before a matched packet Martin Holste (Nov 18)
    • Re: Displaying few packets before a matched packet carlopmart (Nov 18)
      • Re: Displaying few packets before a matched packet Martin Holste (Nov 18)
• Brief Description of Rule Sets Bill Pickens (Nov 18)
  • Re: Brief Description of Rule Sets Joel Esler (Nov 18)
    • Re: Brief Description of Rule Sets Enrico (Nov 22)
      • PulledPork puts empty snort.rules file in rules dir codeforfun (Nov 22)
      • PulledPork puts empty snort.rules file in rules dir codeforfun (Nov 22)
      • Re: PulledPork puts empty snort.rules file in rules dir JJC (Nov 22)
      • Re: Brief Description of Rule Sets Joel Esler (Nov 22)
• Port agnostic application layer protocol identification and parsing Miso Patel (Nov 18)
  • Re: Port agnostic application layer protocol identification and parsing Bennett Todd (Nov 18)
• Some packets logging packet data James Lay (Nov 19)
  • Re: Some alerts not logging packet data James Lay (Nov 23)
    • Re: Some alerts not logging packet data James Lay (Nov 30)
• Weevely PHP Backdoor - Rule Proposal Anestis Bechtsoudis (Nov 20)
  • Re: Weevely PHP Backdoor - Rule Proposal Martin Holste (Nov 20)
    • Re: Weevely PHP Backdoor - Rule Proposal Anestis Bechtsoudis (Nov 20)
      • Re: Weevely PHP Backdoor - Rule Proposal Martin Holste (Nov 20)
    • Re: Weevely PHP Backdoor - Rule Proposal Joel Esler (Nov 20)
• Fast-pattern matcher does not honor ignore_data in the SMTP Preprocessor Joshua Kinard (Nov 20)
  • Re: Fast-pattern matcher does not honor ignore_data in the SMTP Preprocessor Joel Esler (Nov 28)
    • Re: Fast-pattern matcher does not honor ignore_data in the SMTP Preprocessor Joshua Kinard (Nov 28)
      • Re: Fast-pattern matcher does not honor ignore_data in the SMTP Preprocessor Joel Esler (Nov 28)
• path to dynamic rules libraries Windows codeforfun (Nov 21)
  • Re: path to dynamic rules libraries Windows Joel Esler (Nov 21)
    • Re: path to dynamic rules libraries Windows codeforfun (Nov 21)
      • Re: path to dynamic rules libraries Windows Joel Esler (Nov 21)
• Snort EOL Policy Joel Esler (Nov 22)
• Barnyard2 creating lots of tcpdump files Peter Bates (Nov 23)
  • Re: Barnyard2 creating lots of tcpdump files beenph (Nov 23)
• What does snort pcaps include -->/var/log/snort/ amN0P (Nov 23)
• OpenSource RFMON driver WinXp codeforfun (Nov 23)
• [PATCH] Null p->eh in DecodeEthPkt if discarding packet Joshua Kinard (Nov 28)
  • Re: [PATCH] Null p->eh in DecodeEthPkt if discarding packet Joel Esler (Nov 28)
  • Re: [PATCH] Null p->eh in DecodeEthPkt if discarding packet Ryan Jordan (Nov 28)
    • Re: [PATCH] Null p->eh in DecodeEthPkt if discarding packet Joshua Kinard (Nov 28)
• Snort-Inline-1interface Juan Carlos (Nov 28)
• Snort 2.9.2 RC Now Available Snort Releases (Nov 28)
  • <Possible follow-ups>
  • Snort 2.9.2 RC Now Available Snort Releases (Nov 28)
• Sourcefire VRT Certified Snort Rules Update 2011-11-28 Research (Nov 28)
• Snort 2.8.6.1 EOL Reminder Joel Esler (Nov 28)
  • Re: [Snort-sigs] Snort 2.8.6.1 EOL Reminder L0rd Ch0de1m0rt (Dec 01)
    • Re: [Snort-sigs] Snort 2.8.6.1 EOL Reminder Jefferson, Shawn (Dec 01)
      • Re: [Snort-sigs] Snort 2.8.6.1 EOL Reminder L0rd Ch0de1m0rt (Dec 01)
      • Re: [Snort-sigs] Snort 2.8.6.1 EOL Reminder Matthew Jonkman (Dec 01)
      • Re: [Snort-sigs] Snort 2.8.6.1 EOL Reminder Joel Esler (Dec 01)
      • Re: [Emerging-Sigs] [Snort-sigs] Snort 2.8.6.1 EOL Reminder Jeff Kell (Dec 01)
      • Re: [Emerging-Sigs] [Snort-users] Snort 2.8.6.1 EOL Reminder Joel Esler (Dec 01)
      • Re: [Emerging-Sigs] [Snort-sigs] Snort 2.8.6.1 EOL Reminder Nathan (Dec 02)
      • Re: [Emerging-Sigs] [Snort-users] Snort 2.8.6.1 EOL Reminder Joel Esler (Dec 02)
      • Re: [Snort-sigs] [Emerging-Sigs] Snort 2.8.6.1 EOL Reminder Matthew Jonkman (Dec 02)
      • Re: [Emerging-Sigs] [Snort-sigs] Snort 2.8.6.1 EOL Reminder Joel Esler (Dec 02)
      • Re: [Snort-Sigs] Re: [Emerging-Sigs] [Snort-sigs] Snort 2.8.6.1 EOL Reminder Matthew Jonkman (Dec 02)
      • Re: [Emerging-Sigs] [Snort-Sigs] Re: [Snort-sigs] Snort 2.8.6.1 EOL Reminder Joel Esler (Dec 02)
      • Re: [Snort-sigs] Snort 2.8.6.1 EOL Reminder Mike Lococo (Dec 01)
• best signatures set ahmad reza noroozi (Nov 29)
• CanSecWest 2012 Mar 7-9; 2nd call for papers, closes next week, Monday. Dec 5 2011 Dragos Ruiu (Nov 29)
• How to best do DB *and* syslog logging? Miguel Alvarez (Nov 30)
  • Re: How to best do DB *and* syslog logging? Joel Esler (Nov 30)
  • Re: How to best do DB *and* syslog logging? Eoin Miller (Nov 30)
  • Re: How to best do DB *and* syslog logging? beenph (Nov 30)
    • Re: How to best do DB *and* syslog logging? Martin Holste (Nov 30)
      • Re: How to best do DB *and* syslog logging? Dustin Webber (Nov 30)
    • Re: How to best do DB *and* syslog logging? Miguel Alvarez (Nov 30)
      • Re: How to best do DB *and* syslog logging? beenph (Dec 01)
• Re: Snort-users Digest, Vol 66, Issue 25 Matthew Meersman (Nov 30)
• Sourcefire VRT Certified Snort Rules Update 2011-12-01 Research (Dec 01)
• performance improvement with pcre v8.20 + jit ? rmkml (Dec 01)
  • Re: [Snort-users] performance improvement with pcre v8.20 + jit ? Joel Esler (Dec 01)
• Wayne Chang is out of the office Wayne Chang (Dec 01)
  • Re: Wayne Chang is out of the office Randal T. Rioux (Dec 02)
    • Re: Wayne Chang is out of the office Castle, Shane (Dec 05)
      • Re: Wayne Chang is out of the office Martin Holste (Dec 05)
• 2.9.1.2/2.9.2 and Active Response Jim Hranicky (Dec 02)
• ProFTPD FreeBSD FTPD remote root exploit rules Ozan UÇAR (Dec 03)
• Question about Inline mode Albert E. Whale (Dec 04)
  • Re: Question about Inline mode NA (Dec 04)
    • Re: Question about Inline mode Albert E. Whale (Dec 04)
      • Re: Question about Inline mode Michael Altizer (Dec 04)
      • Re: Question about Inline mode John Liss (Dec 05)
• GRE Rule vmpc vmpc (Dec 04)
  • Re: GRE Rule Dina Bruzek (Dec 05)
    • Re: GRE Rule PS (Dec 04)
      • Re: GRE Rule Joel Esler (Dec 05)
  • Re: GRE Rule Bad Horse (Dec 06)
• Amazon EC2 Snort Image Raphael Lechner (Dec 05)
  • <Possible follow-ups>
  • Amazon EC2 Snort Image Raphael Lechner (Dec 05)
• Reputation Preprocessor Shlomi Musseri (Dec 05)
  • Reputation Preprocessor Shlomi Musseri (Dec 07)
    • Re: Reputation Preprocessor Joel Esler (Dec 07)
      • Re: Reputation Preprocessor Hui Cao (Dec 12)
• Latest snort.conf Weir, Jason (Dec 06)
  • Re: Latest snort.conf Joel Esler (Dec 06)
    • Re: Latest snort.conf Weir, Jason (Dec 06)
      • Re: Latest snort.conf Joel Esler (Dec 06)
      • Re: Latest snort.conf Weir, Jason (Dec 06)
      • Re: Latest snort.conf Joel Esler (Dec 06)
      • Re: Latest snort.conf Weir, Jason (Dec 06)
      • Re: Latest snort.conf Joel Esler (Dec 06)
      • Re: Latest snort.conf Weir, Jason (Dec 06)
      • Re: Latest snort.conf Joel Esler (Dec 06)
      • Re: Latest snort.conf Weir, Jason (Dec 06)
• Snort Manual - --enable-mpls missing Weir, Jason (Dec 06)
  • Re: Snort Manual - --enable-mpls missing Eoin Miller (Dec 06)
    • Re: Snort Manual - --enable-mpls missing Weir, Jason (Dec 06)
  • Re: Snort Manual - --enable-mpls missing Joel Esler (Dec 06)
• sid:13272; rule is not so good Miso Patel (Dec 06)
  • Re: sid:13272; rule is not so good Joel Esler (Dec 06)
  • Re: sid:13272; rule is not so good rmkml (Dec 06)
    • Re: sid:13272; rule is not so good Miso Patel (Dec 06)
      • Re: sid:13272; rule is not so good rmkml (Dec 06)
      • Re: sid:13272; rule is not so good Miso Patel (Dec 06)
      • Re: sid:13272; rule is not so good rmkml (Dec 06)
      • Re: sid:13272; rule is not so good Will Metcalf (Dec 06)
      • Re: sid:13272; rule is not so good Joel Esler (Dec 06)
• 2.9.2-rc segfaults Jim Hranicky (Dec 07)
  • Re: 2.9.2-rc segfaults Russ Combs (Dec 07)
    • Re: 2.9.2-rc segfaults Jim Hranicky (Dec 07)
• Sourcefire VRT Certified Snort Rules Update 2011-12-07 Research (Dec 07)
  • Re: Sourcefire VRT Certified Snort Rules Update 2011-12-07 Michael Scheidell (Dec 08)
    • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Weir, Jason (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Michael Scheidell (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Weir, Jason (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Michael Scheidell (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Joel Esler (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Michael Scheidell (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Joel Esler (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Michael Scheidell (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Joel Esler (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Nigel Houghton (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update2011-12-07 Joel Esler (Dec 08)
    • Re: Sourcefire VRT Certified Snort Rules Update 2011-12-07 Geoffrey Sanders (Dec 08)
      • Re: Sourcefire VRT Certified Snort Rules Update 2011-12-07 Michael Scheidell (Dec 08)
• [HITB-Announce] HITB2012AMS Call For Papers Now Open Hafez Kamal (Dec 07)
• broke snort. file_data_ports Michael Scheidell (Dec 08)
  • Re: broke snort. file_data_ports Nigel Houghton (Dec 08)
    • Re: broke snort. file_data_ports Michael Scheidell (Dec 08)
      • Re: broke snort. file_data_ports Nigel Houghton (Dec 08)
• update via oinkmaster PAURON, GUILLAUME (GUILLAUME) (Dec 09)
  • Re: update via oinkmaster JJC (Dec 09)
  • Re: update via oinkmaster Joel Esler (Dec 09)
    • Re: update via oinkmaster PAURON, GUILLAUME (GUILLAUME) (Dec 09)
      • Re: update via oinkmaster Joel Esler (Dec 09)
      • Re: update via oinkmaster PAURON, GUILLAUME (GUILLAUME) (Dec 09)
      • Re: update via oinkmaster Joel Esler (Dec 09)
      • Re: update via oinkmaster PAURON, GUILLAUME (GUILLAUME) (Dec 09)
      • Re: update via oinkmaster Joel Esler (Dec 09)
      • Re: update via oinkmaster JJC (Dec 09)
• how to block attacker in switch? st4rtx (Dec 09)
  • Re: how to block attacker in switch? Joel Esler (Dec 10)
• i have a broblem in pulledpork st4rtx (Dec 09)
  • Re: i have a broblem in pulledpork Joel Esler (Dec 10)
    • Re: i have a broblem in pulledpork JJ Cummings (Dec 10)
• Re: [Emerging-Sigs] Rule 18773 Joel Esler (Dec 10)
  • Re: [Emerging-Sigs] Rule 18773 Lay, James (Dec 12)
• snort not record alert troxlinux (Dec 10)
• Newbie question: reject rule for IPv6 K b (Dec 10)
  • Re: Newbie question: reject rule for IPv6 JJ Cummings (Dec 10)
    • Re: Newbie question: reject rule for IPv6 K b (Dec 11)
      • Re: Newbie question: reject rule for IPv6 K b (Dec 11)
      • Re: Newbie question: reject rule for IPv6 K b (Dec 12)
• Need help to detect BOTNET-CNC Palevo bot DNS attack babu dheen (Dec 11)
  • Re: Need help to detect BOTNET-CNC Palevo bot DNS attack James Lay (Dec 11)
    • Re: Need help to detect BOTNET-CNC Palevo bot DNSattack Jason Haar (Dec 12)
      • Re: Need help to detect BOTNET-CNC Palevo bot DNSattack babu dheen (Dec 12)
      • Re: Need help to detect BOTNET-CNC Palevo bot DNSattack Martin Holste (Dec 12)
      • Re: Need help to detect BOTNET-CNC Palevo bot DNSattack babu dheen (Dec 13)
      • Re: Need help to detect BOTNET-CNC Palevo bot DNSattack Martin Holste (Dec 13)
    • Re: Need help to detect BOTNET-CNC Palevo bot DNS attack babu dheen (Dec 12)
      • Re: Need help to detect BOTNET-CNC Palevo bot DNS attack babu dheen (Dec 12)
      • Re: Need help to detect BOTNET-CNC Palevo bot DNS attack Kevin Ross (Dec 12)
• overloaded system after upgrading Yossi Asayag (Dec 12)
  • overloaded system after upgrading Yossi Asayag (Dec 12)
• I wanna log packets to database of which the ip_src is my own pc, but failed. Kinka (Dec 12)
• RE : overloaded system after upgrading rmkml () yahoo fr (Dec 12)
  • <Possible follow-ups>
  • Re: RE : overloaded system after upgrading Yossi Asayag (Dec 13)
• automatically generate and email a daily report? MLP SCADA (Dec 12)
  • <Possible follow-ups>
  • Re: automatically generate and email a daily report? Lay, James (Dec 12)
    • Re: automatically generate and email a daily report? Martin Holste (Dec 13)
• RE : Re: RE : overloaded system after upgrading rmkml () yahoo fr (Dec 13)
  • Re: RE : Re: RE : overloaded system after upgrading Yossi Asayag (Dec 13)
• [Stats] Get dropped packets count while snort runing (/proc/xxxx search) Thibault - Gonfreecs - (Dec 13)
  • Re: [Stats] Get dropped packets count while snort runing (/proc/xxxx search) Joel Esler (Dec 13)
    • Re: [Stats] Get dropped packets count while snort runing (/proc/xxxx search) Jefferson, Shawn (Dec 13)
      • Re: [Stats] Get dropped packets count while snort runing (/proc/xxxx search) Joel Esler (Dec 13)
    • Re: [Stats] Get dropped packets count while snort runing (/proc/xxxx search) Thibault SOC (Dec 14)
  • Message not available
    • Message not available
      • Re: [Stats] Get dropped packets count while snort runing (/proc/xxxx search) Thibault SOC (Dec 14)
• Get dropped packets count while snort runing (/proc/xxxx search)‏ tito toto (Dec 13)
• RE : Re: RE : Re: RE : overloaded system after upgrading rmkml () yahoo fr (Dec 13)
• Sourcefire VRT Certified Snort Rules Update 2011-12-13 Research (Dec 13)
• pppoe Виктор Захаров (Dec 13)
• Hogger Mike Kun (Dec 13)
  • Re: Hogger Jefferson, Shawn (Dec 13)
    • Re: Hogger Edward Fjellskål (Dec 14)
  • Re: Hogger Joel Esler (Dec 13)
• RE : Re: RE : Re: RE : Re: RE : overloaded system after upgrading rmkml () yahoo fr (Dec 14)
  • Re: RE : Re: RE : Re: RE : Re: RE : overloaded system after upgrading rmkml (Dec 18)
• Snort 2.9.2 Now Available Snort Releases (Dec 14)
  • <Possible follow-ups>
  • Snort 2.9.2 Now Available Snort Releases (Dec 14)
• Error Building Snort 2.9.1.2 on FreeBSD, Fix preinstall flex Robert Z (Dec 14)
  • Re: Error Building Snort 2.9.1.2 on FreeBSD, Fix preinstall flex Ryan Steinmetz (Dec 17)
• FreeBSD 9 or 8.x to install snort 2.9.2 carlopmart (Dec 15)
  • Re: FreeBSD 9 or 8.x to install snort 2.9.2 Russ Combs (Dec 15)
    • Re: FreeBSD 9 or 8.x to install snort 2.9.2 carlopmart (Dec 15)
• Snort.conf examples page to be updated? Weir, Jason (Dec 15)
  • Re: Snort.conf examples page to be updated? Joel Esler (Dec 15)
    • Re: Snort.conf examples page to be updated? Weir, Jason (Dec 15)
• lex is insufficient? (daq 0.6.2) tgiles (Dec 15)
  • Re: lex is insufficient? (daq 0.6.2) Michael Altizer (Dec 15)
    • Re: [Snort-users] lex is insufficient? (daq 0.6.2) tgiles (Dec 16)
      • Re: lex is insufficient? (daq 0.6.2) Michael Altizer (Dec 16)
• Problem About running Snort Agbede Bunmi Michael (Dec 16)
• AUTO: Mark J Payette is out of the office. (returning 01/03/2012) mpayette (Dec 16)
• Snort uses 90% of CPU babu dheen (Dec 16)
  • Re: Snort uses 90% of CPU Yossi Asayag (Dec 17)
• Input daq/patch for reading from daemonlogger output files Bjørnar Ness (Dec 18)
• Could not stat dynamic module path "/usr/lib64/snort_dynamicrule" Shane (Dec 18)
  • Re: Could not stat dynamic module path "/usr/lib64/snort_dynamicrule" Jefferson Diego Gomes Rosa (Dec 19)
  • Re: Could not stat dynamic module path"/usr/lib64/snort_dynamicrule" Lay, James (Dec 19)
• disable frag3 Azfar Hashmi (Dec 19)
  • Re: disable frag3 Joel Esler (Dec 19)
    • Re: disable frag3 Azfar Hashmi (Dec 19)
      • Fwd: Re: disable frag3 Azfar Hashmi (Dec 19)
      • Re: Fwd: Re: disable frag3 Joel Esler (Dec 20)
      • Re: Fwd: Re: disable frag3 Azfar Hashmi (Dec 23)
      • Re: Fwd: Re: disable frag3 Joel Esler (Dec 23)
• Sourcefire VRT Certified Snort Rules Update 2011-12-19 Research (Dec 19)
• about ParseSnortConf function in 2.9.2 || configuration file parsing based on policy id why? mitesh jadia (Dec 21)
• rules update on 2.8 hermit (Dec 21)
  • Re: rules update on 2.8 Nick Moore (Dec 21)
    • Re: rules update on 2.8 hermit (Dec 21)
      • Re: rules update on 2.8 Joel Esler (Dec 21)
      • Re: rules update on 2.8 Nick Moore (Dec 21)
    • Re: rules update on 2.8 Jason Haar (Dec 22)
• Cross compiling dynamic preprocessors cannot resolve _dpd Ron Brash (Dec 21)
  • Re: Cross compiling dynamic preprocessors cannot resolve _dpd Jason Wallace (Dec 24)
    • Re: Cross compiling dynamic preprocessors cannot resolve _dpd Joel Esler (Dec 24)
• DCERCP2 support for byte_extract not implemented? Joshua Kinard (Dec 21)
• UDP packet size limit Document Retention (Dec 23)
  • Re: UDP packet size limit Russ Combs (Dec 23)
• RE : UDP packet size limit rmkml () yahoo fr (Dec 23)
  • <Possible follow-ups>
  • RE : UDP packet size limit rmkml () yahoo fr (Dec 23)
• byte_jump + Stream5, should it work? Shaiming Hsiung (Dec 24)
  • Re: byte_jump + Stream5, should it work? rmkml (Dec 24)
  • Re: byte_jump + Stream5, should it work? Joel Esler (Dec 24)
    • Re: byte_jump + Stream5, should it work? Shaiming Hsiung (Dec 27)
      • Re: byte_jump + Stream5, should it work? rmkml (Dec 27)
      • Re: [Snort-users] byte_jump + Stream5, should it work? rmkml (Dec 27)
• can't log send out packets hzmiaowang (Dec 24)
  • Re: can't log send out packets Joel Esler (Dec 24)
  • <Possible follow-ups>
  • Re: can't log send out packets hzmiaowang (Dec 28)
• [PATCH] Add a better example for pcre in the manual Joshua Kinard (Dec 26)
• [PATCH] Remove the variable modifiers section in the manual. Joshua Kinard (Dec 26)
• Snort /var/log/snort/tcpdump<> amN0P (Dec 26)
  • Re: Snort /var/log/snort/tcpdump<> Eoin Miller (Dec 26)
    • Re: Snort /var/log/snort/tcpdump<> Amit B (Dec 27)
• [PATCH] Add 'mask' parameter to byte_jump and byte_extract Joshua Kinard (Dec 26)
• snort.conf in 2.9.2 and VRT tarball Miguel Alvarez (Dec 27)
  • Re: snort.conf in 2.9.2 and VRT tarball Joel Esler (Dec 30)
    • Re: snort.conf in 2.9.2 and VRT tarball Miguel Alvarez (Dec 30)
• Snort Return/Response packets Thibault SOC (Dec 28)
  • Re: Snort Return/Response packets Alex Kirk (Dec 28)
    • Re: Snort Return/Response packets Thibault SOC (Dec 28)
• Sourcefire VRT Certified Snort Rules Update 2011-12-27 Research (Dec 28)
• Changes made to the Snort.conf Joel Esler (Dec 28)
  • Re: [Snort-Sigs] Changes made to the Snort.conf Miguel Alvarez (Dec 28)
    • Re: [Snort-Sigs] Changes made to the Snort.conf Joel Esler (Dec 29)
• snort seminars in germany ? macbroadcast  (Dec 28)
• Snort Manual - 3.5.21 urilen Eoin Miller (Dec 28)
• Re: Technical queries Joel Esler (Dec 29)
  • <Possible follow-ups>
  • Re: Technical queries Sandip Bankewar (Dec 30)
  • FW: Technical queries Sandip Bankewar (Dec 30)
• Snort daq / nfq / "content: " not working... Jesko Mägle (Dec 30)
• Pulled Pork - Error 500 when fetching Jomana Malone (Dec 30)
• fast pattern matcher and http_cookie? Eoin Miller (Dec 30)

Previous period

Next period