Snort: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

916 messages starting Jan 01 14 and ending Mar 31 14
Date index | Thread index | Author index

• Re: Snort & Barnyard James (Jan 01)
  • Re: Snort & Barnyard Ayodele Okeowo (Jan 01)
    • Re: Snort & Barnyard Joel Esler (jesler) (Jan 02)
• How to activate Snort as IPS and other question sua yong (Jan 02)
• Snort is not able to forward report to Base. Stephen Fernandis [IT Shared Services – Hub] (Jan 03)
  • Re: Snort is not able to forward report to Base. Ayodele Okeowo (Jan 03)
    • Re: Snort is not able to forward report to Base. Stephen Fernandis [IT Shared Services – Hub] (Jan 03)
      • Re: Snort is not able to forward report to Base. waldo kitty (Jan 03)
      • Re: Snort is not able to forward report to Base. Stephen Fernandis [IT Shared Services – Hub] (Jan 03)
      • Re: Snort is not able to forward report to Base. Ayodele Okeowo (Jan 03)
      • Re: Snort is not able to forward report to Base. waldo kitty (Jan 03)
      • Re: Snort is not able to forward report to Base. William Rehnquyst (Jan 16)
      • Re: Snort is not able to forward report to Base. waldo kitty (Jan 16)
      • Re: Snort is not able to forward report to Base. William Rehnquyst (Jan 17)
      • Re: Snort is not able to forward report to Base. Doug Burks (Jan 04)
• Re: Can snort dump full pcap of alert? Onno van der Leun (Jan 03)
• I am a newbie Fabien Delmotte (Jan 03)
  • Re: I am a newbie waldo kitty (Jan 03)
    • Re: I am a newbie Fabien Delmotte (Jan 03)
      • Re: I am a newbie waldo kitty (Jan 03)
• Barebones Snort Install Thomas Hyslip (Jan 03)
• How to configure Snort to run with pf_ring sua yong (Jan 03)
  • Re: How to configure Snort to run with pf_ring Doug Burks (Jan 04)
• Is it possible to compile Barnyard2 with MinGW/MSYS ResQue (Jan 05)
  • <Possible follow-ups>
  • Is it possible to compile Barnyard2 with MinGW/MSYS ResQue (Jan 05)
• Time out never expires - A 403 error occurred, please wait for the 15 minute timeout ResQue (Jan 05)
  • Re: Time out never expires - A 403 error occurred, please wait for the 15 minute timeout waldo kitty (Jan 05)
  • Re: Time out never expires - A 403 error occurred, please wait for the 15 minute timeout Joel Esler (jesler) (Jan 06)
• Re: OPENFPC Proxy merge Kevin Ross (Jan 06)
  • Re: OPENFPC Proxy merge Kevin Ross (Jan 06)
• Not receiving packets Wayne Andersen (Jan 06)
• [HITB-Announce] HITB Magazine Issue 10 Out Now Hafez Kamal (Jan 06)
• FATAL ERROR: /etc/snort/rules/file-office.rules(32) Undefined variable in the string: $EXTERNAL_NET. Jason Buker (Jan 06)
  • Re: FATAL ERROR: /etc/snort/rules/file-office.rules(32) Undefined variable in the string: $EXTERNAL_NET. Jeremy Hoel (Jan 07)
    • Re: FATAL ERROR: /etc/snort/rules/file-office.rules(32) Undefined variable in the string: $EXTERNAL_NET. Jason Buker (Jan 07)
      • Re: FATAL ERROR: /etc/snort/rules/file-office.rules(32) Undefined variable in the string: $EXTERNAL_NET. Jason Buker (Jan 07)
      • Re: FATAL ERROR: /etc/snort/rules/file-office.rules(32) Undefined variable in the string: $EXTERNAL_NET. Jason Buker (Jan 07)
      • Re: FATAL ERROR: /etc/snort/rules/file-office.rules(32) Undefined variable in the string: $EXTERNAL_NET. Joel Esler (jesler) (Jan 07)
• snort_sysconfig and snort.conf (UNCLASSIFIED) Wright, Jonathon S CTR (US) (Jan 07)
• Snort Anomaly Mr Smith (Jan 08)
  • Fwd: Snort Anomaly Mr Smith (Jan 08)
  • Re: Snort Anomaly Kevin Ross (Jan 08)
    • Re: Snort Anomaly Doug Burks (Jan 09)
      • Re: Snort Anomaly Kevin Ross (Jan 10)
      • Re: Snort Anomaly Kevin Ross (Jan 10)
• [snort-devel] Dynamic Pre-process to decipher packet information Emiliano Fausto (Jan 08)
  • Re: [snort-devel] Dynamic Pre-process to decipher packet information Emiliano Fausto (Jan 14)
• outputting variables for analysts Long, Kerry S (Jan 08)
  • Re: outputting variables for analysts Joel Esler (jesler) (Jan 08)
  • <Possible follow-ups>
  • Re: outputting variables for analysts Long, Kerry S (Jan 08)
  • outputting variables for analysts Long, Kerry S (Jan 08)
    • Re: outputting variables for analysts Joel Esler (jesler) (Jan 08)
• local update repositories amirhossein sabet (Jan 08)
  • Re: local update repositories Joel Esler (jesler) (Jan 08)
• Sourcefire VRT Certified Snort Rules Update 2014-01-07 Research (Jan 08)
• Snort CPU consumptions Balasubramaniam Natarajan (Jan 08)
  • Re: Snort CPU consumptions Patrick Mullen (Jan 08)
    • Re: Snort CPU consumptions waldo kitty (Jan 08)
      • Re: Snort CPU consumptions Balasubramaniam Natarajan (Jan 08)
    • Re: Snort CPU consumptions Balasubramaniam Natarajan (Jan 08)
• Rule message change 27875 Joseph Cooper (Jan 08)
  • Re: Rule message change 27875 Joel Esler (jesler) (Jan 08)
    • Re: Rule message change 27875 Y M (Jan 13)
• snort suddenly not capturing packets Ben Jacobs-Swearingen (Jan 09)
  • Re: snort suddenly not capturing packets Carter Waxman (cwaxman) (Jan 09)
    • Re: snort suddenly not capturing packets Ben Jacobs-Swearingen (Jan 14)
• Rule for initial TCP SYN packet Thomas Hyslip (Jan 09)
  • Re: Rule for initial TCP SYN packet Markus Lude (Jan 09)
    • Re: Rule for initial TCP SYN packet Thomas Hyslip (Jan 09)
• Sourcefire VRT Certified Snort Rules Update 2014-01-09 Research (Jan 09)
• Sensitive_data mask_output doesn't appear to be masking output James Lay (Jan 09)
• Stream5 noisy syslog... Jeff Kell (Jan 10)
  • Re: Stream5 noisy syslog... Nicholas Mavis (nmavis) (Jan 13)
    • Re: Stream5 noisy syslog... Jeff Kell (Jan 13)
• [snort-devel] Creating a new variable into a preprocessor and using it in the rules engine Emiliano Fausto (Jan 10)
  • Re: [snort-devel] Creating a new variable into a preprocessor and using it in the rules engine Emiliano Fausto (Jan 10)
    • Re: [snort-devel] Creating a new variable into a preprocessor and using it in the rules engine Emiliano Fausto (Jan 13)
      • Re: [snort-devel] Creating a new variable into a preprocessor and using it in the rules engine Emiliano Fausto (Jan 15)
• How to install Barnyard2 in Windows (without SQL option) sua yong (Jan 11)
• Alert based on website URL Feroz Basir (Jan 12)
  • Re: Alert based on website URL Nicholas Mavis (nmavis) (Jan 13)
    • Re: Alert based on website URL Feroz Basir (Jan 13)
      • Re: Alert based on website URL Nicholas Mavis (nmavis) (Jan 13)
      • Re: Alert based on website URL Feroz Basir (Jan 13)
      • Re: Alert based on website URL Feroz Basir (Jan 20)
      • Re: Alert based on website URL Joel Esler (jesler) (Jan 20)
      • Re: Alert based on website URL Feroz Basir (Jan 21)
• Re: Bad range in Snort rules Lukas Matt (Jan 13)
  • Re: Bad range in Snort rules Alex McDonnell (Jan 13)
    • Re: Bad range in Snort rules Lukas Matt (Jan 13)
      • Re: Bad range in Snort rules Alex McDonnell (Jan 13)
• New rule offered for detecting Netgear password recovery rmkml (Jan 13)
  • Re: New rule offered for detecting Netgear password recovery Antonin (Jan 13)
• Reported Libpcap 1.5.2 issues Joel Esler (jesler) (Jan 14)
• fast_pattern:only in rule 2101390 (GPL SHELLCODE x86 inc ebx NOOP)? Cyrille Bollu (Jan 14)
• Sourcefire VRT Certified Snort Rules Update 2014-01-14 Research (Jan 14)
• New rule offered for detecting Zimbra conf/localconfig.xml attempt rmkml (Jan 15)
  • Re: [Emerging-Sigs] New rule offered for detecting Zimbra conf/localconfig.xml attempt Will Metcalf (Jan 16)
• [HITB-Announce] #HITB2014AMS Call for Papers - FINAL CALL Hafez Kamal (Jan 16)
• Sourcefire VRT Certified Snort Rules Update 2014-01-16 Research (Jan 16)
• unified2 alert files with trailing period and no appended timestamp? Mike Cox (Jan 17)
  • Re: unified2 alert files with trailing period and no appended timestamp? Bhagya Bantwal (Jan 17)
    • Re: unified2 alert files with trailing period and no appended timestamp? Mike Cox (Jan 17)
      • Re: unified2 alert files with trailing period and no appended timestamp? Bhagya Bantwal (Jan 21)
      • Re: unified2 alert files with trailing period and no appended timestamp? Mike Cox (Jan 24)
• Is Snort active in Active Response when it is in NIDS mode? sua yong (Jan 17)
  • Re: Is Snort active in Active Response when it is in NIDS mode? Joel Esler (jesler) (Jan 17)
• Barnyard2 process quits when Output:alert_bro is enabled Jeremy Cox (Jan 17)
  • Re: Barnyard2 process quits when Output:alert_bro is enabled Jeremy Cox (Jan 21)
    • Re: Barnyard2 process quits when Output:alert_bro is enabled SnortFan (Jan 22)
• snort installation and usage Adrian Sevcenco (Jan 18)
  • Re: snort installation and usage waldo kitty (Jan 18)
    • Re: snort installation and usage Adrian Sevcenco (Jan 18)
      • Re: snort installation and usage waldo kitty (Jan 18)
• Snort appears to be successfully compiled, but I cannot run it. Gee Zany (Jan 19)
  • Re: Snort appears to be successfully compiled, but I cannot run it. Gee Zany (Jan 20)
    • Re: Snort appears to be successfully compiled, but I cannot run it. Jeremy Hoel (Jan 20)
      • Re: Snort appears to be successfully compiled, but I cannot run it. waldo kitty (Jan 20)
      • Re: Snort appears to be successfully compiled, but I cannot run it. Joel Esler (jesler) (Jan 20)
    • Re: Snort appears to be successfully compiled, but I cannot run it. Y M (Jan 22)
• Content matching question James Lay (Jan 20)
  • Re: Content matching question Joel Esler (jesler) (Jan 20)
    • Re: Content matching question James Lay (Jan 20)
  • Re: Content matching question James Lay (Jan 20)
• lots of false positives for "GPL SQL user name buffer overflow attempt" Cyrille Bollu (Jan 21)
  • Re: lots of false positives for "GPL SQL user name buffer overflow attempt" Joel Esler (jesler) (Jan 21)
    • Re: lots of false positives for "GPL SQL user name buffer overflow attempt" Cyrille Bollu (Jan 21)
      • Re: lots of false positives for "GPL SQL user name buffer overflow attempt" rmkml (Jan 21)
• Snort http_method not matching POST request on certain spanned networks James P (Jan 21)
• non-standard ping messages Jefferson, Shawn (Jan 21)
  • Re: non-standard ping messages James Lay (Jan 21)
• snort rules Shalvi Srivastava (Jan 21)
  • Re: snort rules Joel Esler (jesler) (Jan 22)
  • <Possible follow-ups>
  • Snort rules Michal Šutta (Feb 23)
• Is it possible to setup inline mode with 1 NIC ? Gee Zany (Jan 22)
  • Re: Is it possible to setup inline mode with 1 NIC ? Y M (Jan 22)
    • Re: Is it possible to setup inline mode with 1 NIC ? Gee Zany (Jan 22)
      • Re: Is it possible to setup inline mode with 1 NIC ? waldo kitty (Jan 22)
• create-sidmap.pl SnortFan (Jan 22)
  • Re: create-sidmap.pl Y M (Jan 22)
    • Re: create-sidmap.pl SnortFan (Jan 22)
      • Re: create-sidmap.pl Y M (Jan 22)
• VRT Categories SnortFan (Jan 22)
  • Re: VRT Categories Y M (Jan 22)
    • Re: VRT Categories SnortFan (Jan 22)
      • Re: VRT Categories Y M (Jan 22)
      • Re: VRT Categories SnortFan (Jan 22)
      • Re: VRT Categories Joel Esler (jesler) (Jan 23)
      • Re: VRT Categories SnortFan (Jan 23)
• Sourcefire VRT Certified Snort Rules Update 2014-01-22 Research (Jan 22)
• Re: Network cards for IPS & query related to PFRING Anshuman Anil Deshmukh (Jan 22)
• Pulledpork and proprocessor rules Dave Corsello (Jan 23)
  • Re: Pulledpork and proprocessor rules SnortFan (Jan 23)
    • Re: Pulledpork and proprocessor rules SnortFan (Jan 23)
      • Re: Pulledpork and proprocessor rules Dave Corsello (Jan 23)
      • Re: Pulledpork and proprocessor rules SnortFan (Jan 24)
      • Re: Pulledpork and proprocessor rules Lay, James (Jan 24)
      • Message not available
      • Re: Pulledpork and proprocessor rules Dave Corsello (Jan 24)
• A question on ethernet padding James Lay (Jan 23)
  • Re: A question on ethernet padding Jeremy Hoel (Jan 23)
    • Re: A question on ethernet padding James Lay (Jan 23)
      • Re: A question on ethernet padding Jeremy Hoel (Jan 23)
      • Re: A question on ethernet padding Jeremy Hoel (Jan 23)
      • Re: A question on ethernet padding James Lay (Jan 23)
• Aurora Exploit Attempt Alert One Hour Delay LaTonya Hall (Jan 23)
  • Re: Aurora Exploit Attempt Alert One Hour Delay waldo kitty (Jan 23)
  • Re: Aurora Exploit Attempt Alert One Hour Delay Kevin Ross (Jan 23)
    • Re: Aurora Exploit Attempt Alert One Hour Delay LaTonya Hall (Jan 23)
      • Re: Aurora Exploit Attempt Alert One Hour Delay Mike Miller (Jan 23)
      • Re: Aurora Exploit Attempt Alert One Hour Delay Latonya Hall (Jan 23)
      • Re: Aurora Exploit Attempt Alert One Hour Delay Mike Miller (Jan 23)
      • Re: Aurora Exploit Attempt Alert One Hour Delay Latonya Hall (Jan 23)
      • Re: Aurora Exploit Attempt Alert One Hour Delay James Lay (Jan 23)
  • Re: Aurora Exploit Attempt Alert One Hour Delay Eoin Miller (Jan 23)
    • Re: Aurora Exploit Attempt Alert One Hour Delay Latonya Hall (Jan 23)
    • Re: Aurora Exploit Attempt Alert One Hour Delay Joel Esler (jesler) (Jan 23)
• Snort 2.9.6 Now Available Snort Releases (Jan 23)
  • <Possible follow-ups>
  • Snort 2.9.6 Now Available Snort Releases (Jan 23)
• Sourcefire VRT Certified Snort Rules Update 2014-01-23 Research (Jan 23)
• Vbs rat threat rules Feroz Basir (Jan 23)
  • <Possible follow-ups>
  • Vbs rat threat rules Feroz Basir (Jan 25)
    • Re: Vbs rat threat rules Feroz Basir (Jan 27)
      • Re: Vbs rat threat rules Joel Esler (jesler) (Jan 27)
      • Re: Vbs rat threat rules Feroz Basir (Jan 28)
      • Re: [Snort-users] Vbs rat threat rules waldo kitty (Jan 28)
      • Re: Vbs rat threat rules Kevin Ross (Jan 28)
• Notes for Community rule 29456 Jeremy Hoel (Jan 23)
• Services of Snort suddenly stop Stephen Fernandis [IT Shared Services – Hub] (Jan 24)
  • Re: Services of Snort suddenly stop Stephen Fernandis [IT Shared Services – Hub] (Jan 27)
• Alerts where source and destination addresses equal 0.0.0.0 Cyrille Bollu (Jan 24)
  • Re: Alerts where source and destination addresses equal 0.0.0.0 James Lay (Jan 24)
    • Re: Alerts where source and destination addresses equal 0.0.0.0 Cyrille Bollu (Jan 24)
    • Re: Alerts where source and destination addresses equal 0.0.0.0 waldo kitty (Jan 24)
• Feodo Botnet Lukas Matt (Jan 24)
  • Re: Feodo Botnet James Lay (Jan 24)
    • Re: Feodo Botnet Arbeiter, Stefan (K-SIS-O/1) (Jan 24)
• Running snort on virtual machine Feroz Basir (Jan 24)
  • Re: Running snort on virtual machine SnortFan (Jan 24)
• consultation question simegnew yihunie (Jan 24)
  • Re: consultation question Jeremy Hoel (Jan 24)
    • Re: consultation question Russ Combs (rucombs) (Jan 26)
      • Re: consultation question Jeremy Hoel (Jan 25)
  • Re: consultation question Ben Jacobs-Swearingen (Jan 26)
• Is there something about pulledpork 0.7.0 I'm not getting? Tony Robinson (Jan 25)
  • Re: Is there something about pulledpork 0.7.0 I'm not getting? Y M (Jan 26)
    • Re: Is there something about pulledpork 0.7.0 I'm not getting? Tony Robinson (Jan 26)
      • Re: Is there something about pulledpork 0.7.0 I'm not getting? simegnew yihunie (Jan 26)
      • Re: Is there something about pulledpork 0.7.0 I'm not getting? waldo kitty (Jan 26)
• Thousands of alerts after upgrade Leo (Jan 26)
  • Re: Thousands of alerts after upgrade SnortFan (Jan 26)
  • Re: Thousands of alerts after upgrade SnortFan (Jan 31)
• Adding new fast pattern matching software SIVA KRISHNA GUDIVADA (Jan 26)
• error while loading shared libraries: libdnet.1: SnortFan (Jan 27)
  • Re: error while loading shared libraries: libdnet.1: waldo kitty (Jan 27)
    • Re: error while loading shared libraries: libdnet.1: SnortFan (Jan 28)
• How much of a stream(javascript) is actually blocked on event? Lil Evil (Jan 27)
  • Re: How much of a stream(javascript) is actually blocked on event? waldo kitty (Jan 27)
    • Re: How much of a stream(javascript) is actually blocked on event? Joel Esler (jesler) (Jan 27)
• EOL Page Updated???? Starner, Mark (Jan 28)
• Www.snort.org down? SnortFan (Jan 28)
  • Re: Www.snort.org down? Michael Brown (Jan 28)
    • Re: Www.snort.org down? James Lay (Jan 28)
      • Re: Www.snort.org down? James Lay (Jan 28)
      • Re: Www.snort.org down? Y M (Jan 28)
      • Re: Www.snort.org down? SnortFan (Jan 28)
      • Re: Www.snort.org down? Joel Esler (jesler) (Jan 28)
• Sourcefire VRT Certified Snort Rules Update 2014-01-28 Research (Jan 28)
• sid: 2012647 How to understand user upload file to the server, or download Сергей Малинкин (Jan 29)
  • Re: [Snort-sigs] sid: 2012647 How to understand user upload file to the server, or download Y M (Feb 04)
• Linking this with that to create an alert James Lay (Jan 29)
  • Re: Linking this with that to create an alert rmkml (Jan 29)
    • Re: Linking this with that to create an alert James Lay (Jan 29)
• Sourcefire VRT Certified Snort Rules Update 2014-01-30 Research (Jan 30)
• 2 questions about Stream5 handling of missing data John Eure (Jan 30)
  • Re: 2 questions about Stream5 handling of missing data Russ Combs (Feb 03)
    • Re: 2 questions about Stream5 handling of missing data John Eure (Feb 04)
  • Re: 2 questions about Stream5 handling of missing data Russ Combs (rucombs) (Feb 07)
• Minor snort patch file John Eure (Jan 30)
  • Re: Minor snort patch file Bhagya Bantwal (Jan 31)
• Problems with MPLS traffic Packet Hack (Jan 31)
  • Re: Problems with MPLS traffic Steven Sturges (Feb 01)
    • Re: Problems with MPLS traffic Packet Hack (Feb 17)
• Re: getting sensitive-data cc# alert to fire jason (Feb 01)
  • Re: getting sensitive-data cc# alert to fire jason (Feb 03)
    • Re: getting sensitive-data cc# alert to fire James Lay (Feb 03)
      • Re: getting sensitive-data cc# alert to fire jason (Feb 03)
      • Re: getting sensitive-data cc# alert to fire Joel Esler (jesler) (Feb 03)
      • Re: getting sensitive-data cc# alert to fire waldo kitty (Feb 03)
      • Re: getting sensitive-data cc# alert to fire rmkml (Feb 03)
      • Re: getting sensitive-data cc# alert to fire waldo kitty (Feb 03)
      • Re: getting sensitive-data cc# alert to fire jason (Feb 03)
      • Re: getting sensitive-data cc# alert to fire Y M (Feb 04)
      • Re: getting sensitive-data cc# alert to fire jason (Feb 11)
• Barnyard2 problems with reputation preproc rules Dave Corsello (Feb 01)
  • Re: Barnyard2 problems with reputation preproc rules beenph (Feb 01)
    • Re: Barnyard2 problems with reputation preproc rules Dave Corsello (Feb 02)
      • Re: Barnyard2 problems with reputation preproc rules beenph (Feb 02)
      • Re: Barnyard2 problems with reputation preproc rules Dave Corsello (Feb 03)
      • Re: Barnyard2 problems with reputation preproc rules beenph (Feb 03)
      • Re: Barnyard2 problems with reputation preproc rules Dave Corsello (Feb 03)
      • Message not available
      • Message not available
      • Message not available
      • Message not available
      • Message not available
      • Re: Barnyard2 problems with reputation preproc rules Dave Corsello (Feb 10)
      • Re: Barnyard2 problems with reputation preproc rules Dave Corsello (Feb 12)
      • Re: Barnyard2 problems with reputation preproc rules beenph (Feb 12)
      • Re: Barnyard2 problems with reputation preproc rules Dave Corsello (Feb 07)
• AUTO: AYYILDIZ, Cihan is out of the office. (returning 10.02.2014) Cihan AYYILDIZ (Feb 02)
• Setting up Snort with router span port Michael Brown (Feb 03)
  • Re: Setting up Snort with router span port Y M (Feb 04)
• Snort and OpenVPN Dmitry Korzhevin (Feb 04)
  • Re: Snort and OpenVPN Kevin Ross (Feb 04)
    • Re: Snort and OpenVPN Dmitry Korzhevin (Feb 04)
      • Message not available
      • Re: Snort and OpenVPN Dmitry Korzhevin (Feb 04)
• Trojan Linkup sig Y M (Feb 04)
  • Re: Trojan Linkup sig Carlos Pacho (Feb 04)
    • Re: Trojan Linkup sig Y M (Feb 04)
• Sourcefire VRT Certified Snort Rules Update 2014-02-04 Research (Feb 04)
• Rawbytes needed? James Lay (Feb 05)
  • Re: Rawbytes needed? Y M (Feb 05)
    • Re: Rawbytes needed? James Lay (Feb 05)
• New rule offered for detecting Ping NVidia rmkml (Feb 05)
  • Re: [Emerging-Sigs] New rule offered for detecting Ping NVidia Will Metcalf (Feb 10)
    • Re: [Emerging-Sigs] New rule offered for detecting Ping NVidia Jeremy Hoel (Feb 10)
• event id = 0 on all unified2 events Eugenio Pérez (Feb 06)
  • Re: event id = 0 on all unified2 events Jeremy Hoel (Feb 06)
• Signature Description Oddness Starner, Mark (Feb 06)
  • Re: Signature Description Oddness Joel Esler (jesler) (Feb 06)
    • Re: Signature Description Oddness Joel Esler (jesler) (Feb 07)
• Sourcefire VRT Certified Snort Rules Update 2014-02-06 Research (Feb 06)
• Can Snort work with erf file? Han Zhang (Feb 07)
  • Re: Can Snort work with erf file? Joel Esler (jesler) (Feb 07)
    • Re: Can Snort work with erf file? Marcos Rodriguez (Feb 07)
• adding IDMEF output logging to snort-2.9.5 Yasin (Feb 07)
  • Re: adding IDMEF output logging to snort-2.9.5 Sandro Poppi (Feb 07)
  • <Possible follow-ups>
  • adding IDMEF output logging to snort-2.9.5 Yasin (Feb 13)
• Re: snort Chipsy Patel (Feb 07)
  • Re: snort Emiliano Fausto (Feb 07)
  • <Possible follow-ups>
  • Snort stephanie sokhn (Mar 25)
    • Re: Snort James Lay (Mar 25)
• [PATCH]: daq-2.0.2 doesn't build shared libs on FreeBSD 10.x Joshua Kinard (Feb 09)
  • Re: [PATCH]: daq-2.0.2 doesn't build shared libs on FreeBSD 10.x Joshua Kinard (Feb 09)
  • Re: [PATCH]: daq-2.0.2 doesn't build shared libs on FreeBSD 10.x Joshua Kinard (Feb 17)
• [PATCH]: Fix build on DragonFlyBSD 3.x Joshua Kinard (Feb 09)
  • Re: [PATCH]: Fix build on DragonFlyBSD 3.x Joshua Kinard (Feb 17)
• Rules with "Established" option, not working sami Sayko (Feb 10)
  • Re: Rules with "Established" option, not working Joel Esler (jesler) (Feb 10)
    • Re: Rules with "Established" option, not working sami Sayko (Feb 10)
      • Re: Rules with "Established" option, not working Joel Esler (jesler) (Feb 10)
      • Re: Rules with "Established" option, not working sami Sayko (Feb 10)
• RE : Re: [Emerging-Sigs] New rule offered for detecting Ping NVidia rmkml (Feb 10)
• Snort 2.9.6.0 rpm for RHEL6.x Feroz Basir (Feb 10)
  • Re: Snort 2.9.6.0 rpm for RHEL6.x Jeremy Hoel (Feb 10)
  • Re: Snort 2.9.6.0 rpm for RHEL6.x waldo kitty (Feb 10)
• Events vs. Alerts Thomas Hyslip (Feb 10)
  • Re: Events vs. Alerts Nicholas Mavis (nmavis) (Feb 11)
• Snort vs. Barnyard2 performance logging to a database Dubrawsky, Ido (Feb 11)
  • Re: Snort vs. Barnyard2 performance logging to a database Y M (Feb 11)
  • Re: Snort vs. Barnyard2 performance logging to a database dandantheitman (Feb 11)
  • Re: Snort vs. Barnyard2 performance logging to a database Balasubramaniam Natarajan (Feb 11)
• sudo snort -Tc snort.conf failure David Montgomery (Feb 11)
  • Re: sudo snort -Tc snort.conf failure David Montgomery (Feb 11)
    • Re: sudo snort -Tc snort.conf failure Nicholas Mavis (nmavis) (Feb 11)
  • Re: sudo snort -Tc snort.conf failure Y M (Feb 11)
• JackPOS sig James Lay (Feb 11)
  • Re: JackPOS sig James Espinosa (Feb 11)
    • Re: JackPOS sig James Lay (Feb 11)
  • Re: JackPOS sig James Lay (Feb 11)
    • Re: JackPOS sig Joel Esler (jesler) (Feb 11)
      • Re: JackPOS sig Joel Esler (jesler) (Feb 14)
      • Re: JackPOS sig James Lay (Feb 14)
• sfportscan not writing to BASE Richard Smollett (Feb 11)
• Sourcefire VRT Certified Snort Rules Update 2014-02-11 Research (Feb 11)
• Getting Incorrect URL Error Message for a working URL MMartin (Feb 11)
  • Re: Getting Incorrect URL Error Message for a working URL MMartin (Feb 11)
  • Re: Getting Incorrect URL Error Message for a working URL Joel Esler (jesler) (Feb 11)
• Careto/Mask Rules Tony Robinson (Feb 11)
  • Re: Careto/Mask Rules Joel Esler (jesler) (Feb 12)
• Snort based on APIs Rodrigo Pimpão (Feb 11)
• Re: Getting Incorrect URL Error Message for a working URL MMartin (Feb 11)
• Re: Snort-users Digest, Vol 93, Issue 13 Aditya Prakash (Feb 11)
• Re: Snort-users Digest, Vol 93, Issue 9 Aditya Prakash (Feb 11)
• [Snort-Devel] SNORT Detection-Plugin just call once Emiliano Fausto (Feb 12)
  • Re: [Snort-Devel] SNORT Detection-Plugin just call once John Eure (Feb 12)
    • Re: [Snort-Devel] SNORT Detection-Plugin just call once Emiliano Fausto (Feb 13)
      • Re: [Snort-Devel] SNORT Detection-Plugin just call once Emiliano Fausto (Feb 13)
      • Re: [Snort-Devel] SNORT Detection-Plugin just call once John Eure (Feb 15)
      • Re: [Snort-Devel] SNORT Detection-Plugin just call once Emiliano Fausto (Feb 17)
• New rule offered for detecting Gameover a new ZeuS variant over smtp rmkml (Feb 12)
• Barnyard2 doesn't read alerts Daniele Gallarato (Feb 13)
  • Re: Barnyard2 doesn't read alerts Joel Esler (jesler) (Feb 13)
    • Re: Barnyard2 doesn't read alerts Daniele Gallarato (Feb 13)
      • Re: Barnyard2 doesn't read alerts beenph (Feb 13)
• Sig thought (wpad) James Lay (Feb 13)
  • Re: Sig thought (wpad) Jeremy Hoel (Feb 13)
    • Re: Sig thought (wpad) James Lay (Feb 13)
  • Re: Sig thought (wpad) Jason Haar (Feb 16)
• Sourcefire VRT Certified Snort Rules Update 2014-02-13 Research (Feb 13)
• Odd 2.6.0 compile error with disable-flexresp3 Jeremy Hoel (Feb 13)
  • Re: Odd 2.6.0 compile error with disable-flexresp3 Joel Esler (jesler) (Feb 14)
• Re: snort configuration priya pat (Feb 13)
  • Re: snort configuration Michael Steele (Feb 13)
  • Re: snort configuration waldo kitty (Feb 13)
  • <Possible follow-ups>
  • snort configuration basant subba (Mar 12)
    • Re: snort configuration Jeremy Hoel (Mar 12)
  • Snort Configuration Nanda Vardhan (Mar 18)
    • Re: Snort Configuration Russ Combs (rucombs) (Mar 19)
  • Snort Configuration Nanda Vardhan (Mar 18)
    • Re: Snort Configuration waldo kitty (Mar 18)
      • Re: Snort Configuration Nanda Vardhan (Mar 19)
      • Re: Snort Configuration waldo kitty (Mar 19)
      • Re: Snort Configuration Nanda Vardhan (Mar 20)
      • Re: Snort Configuration waldo kitty (Mar 20)
• Please feedback me about history of Snort sou (Feb 13)
• Newbie install Snort on a MacBook Pro with Maverick litltbear (Feb 13)
  • Message not available
    • Re: Newbie install Snort on a MacBook Pro with Maverick Richard Harman Jr (rharmanj) (Feb 13)
• Cannot build Snort 2.9.5.6 with --enable-build-dynamic-examples option Hai Minh Nguyen (Feb 13)
  • Re: Cannot build Snort 2.9.5.6 with--enable-build-dynamic-examples option 손은영 (Feb 13)
    • Re: Cannot build Snort 2.9.5.6 with--enable-build-dynamic-examples option Hai Minh Nguyen (Feb 14)
      • Re: Cannot build Snort 2.9.5.6 with--enable-build-dynamic-examples option Russ Combs (rucombs) (Feb 14)
      • Re: Cannot build Snort 2.9.5.6 with--enable-build-dynamic-examples option Hai Minh Nguyen (Feb 17)
• Sourcefire VRT Certified Snort Rules Update 2014-02-14 Research (Feb 14)
• SMTP Backscatter Dave Corsello (Feb 14)
  • Re: SMTP Backscatter Jason Haar (Feb 15)
    • Re: SMTP Backscatter waldo kitty (Feb 15)
      • Re: SMTP Backscatter Dave Corsello (Feb 16)
      • Re: SMTP Backscatter waldo kitty (Feb 16)
      • Re: SMTP Backscatter Jeff Kell (Feb 16)
      • Re: SMTP Backscatter waldo kitty (Feb 16)
      • Message not available
      • Message not available
      • Re: SMTP Backscatter Dave Corsello (Feb 18)
      • Re: SMTP Backscatter waldo kitty (Feb 18)
• Help with snort rule and notifications Trever Leingod (Feb 14)
  • Re: Help with snort rule and notifications SnortFan (Feb 15)
    • Re: Help with snort rule and notifications Trever Leingod (Feb 15)
      • Re: Help with snort rule and notifications Jeremy Hoel (Feb 15)
      • Re: Help with snort rule and notifications Trever Leingod (Feb 16)
      • Re: Help with snort rule and notifications Carter Waxman (cwaxman) (Feb 17)
      • Message not available
      • FW: Help with snort rule and notifications Trever Leingod (Feb 17)
      • Re: FW: Help with snort rule and notifications Carter Waxman (cwaxman) (Feb 17)
      • Re: FW: Help with snort rule and notifications Trever Leingod (Feb 17)
      • Re: FW: Help with snort rule and notifications Carter Waxman (cwaxman) (Feb 17)
      • Message not available
      • FW: FW: Help with snort rule and notifications Trever Leingod (Feb 17)
      • Re: FW: FW: Help with snort rule and notifications Carter Waxman (cwaxman) (Feb 18)
      • Re: FW: FW: Help with snort rule and notifications Trever Leingod (Feb 18)
      • Re: FW: FW: Help with snort rule and notifications Carter Waxman (cwaxman) (Feb 19)
• Ebury SSH Rootkit sig. Y M (Feb 15)
  • Re: Ebury SSH Rootkit sig. Joel Esler (jesler) (Feb 15)
    • Re: Ebury SSH Rootkit sig. Y M (Feb 15)
• flowbits check needed? Y M (Feb 15)
  • Re: flowbits check needed? rmkml (Feb 15)
    • Re: flowbits check needed? Y M (Feb 15)
      • Re: flowbits check needed? Joel Esler (jesler) (Feb 16)
      • Re: flowbits check needed? Y M (Feb 16)
• Snort 2.9.6 and DPX 1.6 test error: undefined libversion Hai Minh Nguyen (Feb 17)
  • Re: Snort 2.9.6 and DPX 1.6 test error: undefined libversion Russ Combs (rucombs) (Feb 17)
    • Re: Snort 2.9.6 and DPX 1.6 test error: undefined libversion Hai Minh Nguyen (Feb 17)
      • Re: Snort 2.9.6 and DPX 1.6 test error: undefined libversion Hai Minh Nguyen (Feb 17)
      • Re: Snort 2.9.6 and DPX 1.6 test error: undefined libversion Russ Combs (rucombs) (Feb 18)
      • Re: Snort 2.9.6 and DPX 1.6 test error: undefined libversion Hai Minh Nguyen (Feb 18)
      • Re: Snort 2.9.6 and DPX 1.6 test error: undefined libversion Russ Combs (rucombs) (Feb 19)
      • Re: Snort 2.9.6 and DPX 1.6 test error: undefined libversion Hai Minh Nguyen (Feb 19)
      • Re: Snort 2.9.6 and DPX 1.6 test error: undefined libversion Hai Minh Nguyen (Feb 20)
• Snort Ebury SSH Rootkit Lukas Matt (Feb 17)
  • Re: Snort Ebury SSH Rootkit Y M (Feb 17)
    • Re: Snort Ebury SSH Rootkit Lukas Matt (Feb 17)
      • Re: Snort Ebury SSH Rootkit Y M (Feb 17)
      • Re: Snort Ebury SSH Rootkit rmkml (Feb 17)
      • Re: Snort Ebury SSH Rootkit Y M (Feb 22)
      • Re: Snort Ebury SSH Rootkit rmkml (Feb 22)
      • Re: Snort Ebury SSH Rootkit Y M (Feb 22)
      • Re: Snort Ebury SSH Rootkit Joel Esler (jesler) (Feb 23)
• Work Practices of Cyber Security Professionals Muhammad Adnan (Feb 17)
• Re-Compiling Snort? MMartin (Feb 17)
  • Re: Re-Compiling Snort? Y M (Feb 17)
    • Re: Re-Compiling Snort? Joel Esler (jesler) (Feb 17)
    • Re: Re-Compiling Snort? MMartin (Feb 17)
• Unable to Compile DPX.C (original file) (dpx-1.6 version) Amtul Saboor (Feb 17)
  • Re: Unable to Compile DPX.C (original file) (dpx-1.6 version) Russ Combs (rucombs) (Feb 17)
    • Re: Unable to Compile DPX.C (original file) (dpx-1.6 version) Amtul Saboor (Feb 17)
      • Re: Unable to Compile DPX.C (original file) (dpx-1.6 version) Amtul Saboor (Feb 18)
      • Re: Unable to Compile DPX.C (original file) (dpx-1.6 version) Russ Combs (rucombs) (Feb 18)
      • Re: Unable to Compile DPX.C (original file) (dpx-1.6 version) Amtul Saboor (Feb 18)
      • Message not available
      • Message not available
      • Message not available
      • Re: Unable to Compile DPX.C (original file) (dpx-1.6 version) Russ Combs (rucombs) (Feb 19)
• Malicious ZenCart redirect sigs James Lay (Feb 17)
  • Re: Malicious ZenCart redirect sigs Carlos Pacho (Feb 18)
• [PATCH]: Fix IP Protocol variable data type in Stream5 Preprocessor Joshua Kinard (Feb 17)
  • Re: [PATCH]: Fix IP Protocol variable data type in Stream5 Preprocessor Carter Waxman (cwaxman) (Mar 10)
• Re: Snort-devel Digest, Vol 91, Issue 13 Nicolae Paladi (Feb 18)
• Snort anomaly detection Mr Smith (Feb 18)
  • Fwd: Snort anomaly detection Mr Smith (Feb 18)
• [PATCH]: src/util.h: Add SnortStrtoull/SnortStrToU64 functions Joshua Kinard (Feb 18)
• Unsubscribe Srinivas Kumar (Feb 18)
• Re: Enabling all the rules for testing using PulledPork? JJC (Feb 18)
• Allowing windows updates to pass through snort Doug Olitsky (Feb 18)
  • Re: Allowing windows updates to pass through snort Tony Reusser (Feb 18)
  • Re: Allowing windows updates to pass through snort Tony Reusser (Feb 18)
  • Re: Allowing windows updates to pass through snort waldo kitty (Feb 18)
  • <Possible follow-ups>
  • FW: Allowing windows updates to pass through snort Tony Reusser (Feb 18)
• Sourcefire VRT Certified Snort Rules Update 2014-02-18 Research (Feb 18)
• Preprocessor disabling question SnortFan (Feb 18)
  • Re: Preprocessor disabling question Joel Esler (jesler) (Feb 18)
    • Re: Preprocessor disabling question SnortFan (Feb 18)
      • Re: Preprocessor disabling question SnortFan (Feb 18)
      • Re: Preprocessor disabling question Joel Esler (jesler) (Feb 19)
• Question about ssh gobbles alert (128:1) Jeremy Hoel (Feb 18)
  • Re: Question about ssh gobbles alert (128:1) Joel Esler (jesler) (Feb 18)
  • Re: Question about ssh gobbles alert (128:1) Joel Esler (jesler) (Feb 18)
    • Re: Question about ssh gobbles alert (128:1) Jeremy Hoel (Feb 18)
• Question Behavior Mode Jorge Maravi (Feb 18)
• Problems with last gen-msg.map in rule set Budinich Galvez, Luis Alberto (Feb 19)
  • Re: Problems with last gen-msg.map in rule set Heine Lysemose (Feb 19)
• Snort failed to stay up after upgrade to 2.9.6.0 Feroz Basir (Feb 19)
  • Re: Snort failed to stay up after upgrade to 2.9.6.0 Jeremy Hoel (Feb 19)
    • Re: Snort failed to stay up after upgrade to 2.9.6.0 Feroz Basir (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Jeremy Hoel (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Michael Brown (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Feroz Basir (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Jeremy Hoel (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Feroz Basir (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Jeremy Hoel (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Feroz Basir (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 SnortFan (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Feroz Basir (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Jeremy Hoel (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Feroz Basir (Feb 20)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Feroz Basir (Feb 20)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Richard Harman Jr (rharmanj) (Feb 20)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Bill Bernsen (Feb 20)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Feroz Basir (Feb 20)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 waldo kitty (Feb 19)
      • Re: Snort failed to stay up after upgrade to 2.9.6.0 Carter Waxman (cwaxman) (Feb 19)
• Snort Alert [1:1000001:1] Angel Chiriboga Torres (Feb 19)
  • Re: Snort Alert [1:1000001:1] Jeremy Hoel (Feb 19)
    • Re: Snort Alert [1:1000001:1] Michael Brown (Feb 19)
• Snort.org Blog: Open Source Community Meeting at RSA next week! Joel Esler (jesler) (Feb 19)
  • Re: [Snort-users] Snort.org Blog: Open Source Community Meeting at RSA next week! Joel Esler (jesler) (Feb 19)
• Snort Standard out / error logging (UNCLASSIFIED) Wright, Jonathon S CTR (US) (Feb 19)
• Patch for Stream5 TCP direction John Eure (Feb 19)
  • Re: Patch for Stream5 TCP direction Carter Waxman (cwaxman) (Feb 20)
    • Re: Patch for Stream5 TCP direction John Eure (Feb 20)
      • Re: Patch for Stream5 TCP direction Russ Combs (rucombs) (Feb 21)
      • Re: Patch for Stream5 TCP direction John Eure (Feb 21)
      • Re: Patch for Stream5 TCP direction Russ Combs (rucombs) (Feb 24)
      • Re: Patch for Stream5 TCP direction John Eure (Feb 25)
• [HITB-Announce] Haxpo CFP Hafez Kamal (Feb 19)
• Receiving alerts for a disabled rule Anshuman Anil Deshmukh (Feb 20)
  • Re: Receiving alerts for a disabled rule Joel Esler (jesler) (Feb 20)
    • Re: Receiving alerts for a disabled rule SnortFan (Feb 20)
    • Re: Receiving alerts for a disabled rule Anshuman Anil Deshmukh (Feb 28)
      • Re: Receiving alerts for a disabled rule SnortFan (Feb 28)
      • Re: Receiving alerts for a disabled rule Anshuman Anil Deshmukh (Mar 08)
      • Re: Receiving alerts for a disabled rule waldo kitty (Feb 28)
• How to activate all rules using PulledPork? Michael Steele (Feb 20)
  • Re: How to activate all rules using PulledPork? SnortFan (Feb 20)
    • Message not available
      • Re: How to activate all rules using PulledPork? SnortFan (Feb 24)
• Sourcefire VRT Certified Snort Rules Update 2014-02-20 Research (Feb 20)
• file carving Long, Kerry S (Feb 21)
  • Re: file carving Hui cao (Feb 21)
• Disablesid.conf and classtype SnortFan (Feb 21)
  • Re: Disablesid.conf and classtype Juan Camilo Valencia (Feb 21)
    • Re: Disablesid.conf and classtype Joel Esler (jesler) (Feb 21)
      • Re: Disablesid.conf and classtype SnortFan (Feb 26)
      • Re: Disablesid.conf and classtype SnortFan (Feb 26)
      • Re: Disablesid.conf and classtype Joel Esler (jesler) (Feb 26)
• Snort install Rule Problem Gierczak, Stan (Feb 21)
  • Re: Snort install Rule Problem James Lay (Feb 21)
    • Re: Snort install Rule Problem Gierczak, Stan (Feb 21)
• SO rules and pulledpork Fred Maillou (Feb 21)
• Snort does not detect attacks Michal Šutta (Feb 22)
  • Re: Snort does not detect attacks waldo kitty (Feb 22)
• Alan Nala Alan Nala (Feb 22)
• SO Rules Michal Šutta (Feb 23)
• (no subject) Michal Šutta (Feb 23)
  • Re: (no subject) Joel Esler (jesler) (Feb 23)
    • Re: (no subject) Mike Miller (Feb 23)
  • <Possible follow-ups>
  • (no subject) basant subba (Mar 11)
  • (no subject) JS (Mar 14)
• I need an IDS that sends critical alerts by email Jeronimo L. Cabral (Feb 24)
  • Re: I need an IDS that sends critical alerts by email Doug Burks (Feb 24)
    • Re: I need an IDS that sends critical alerts by email Jeronimo L. Cabral (Feb 26)
      • Re: I need an IDS that sends critical alerts by email Doug Burks (Feb 26)
• Choosing the best rules Michal Šutta (Feb 24)
  • Re: Choosing the best rules SnortFan (Feb 24)
    • Re: Choosing the best rules Richard Harman Jr (rharmanj) (Feb 24)
      • Re: Choosing the best rules James Lay (Feb 24)
• AUTO: AYYILDIZ, Cihan is out of the office. (returning 03.03.2014) Cihan AYYILDIZ (Feb 24)
• DoS/DDoS :: Bandwidth Benefits Chinmay Mahata (Feb 25)
• Snort 2.9.7.0 Alpha is now available Snort Releases (Feb 25)
  • Re: Snort 2.9.7.0 Alpha is now available Joshua Kinard (Feb 26)
• Snort 2.9.7.0 Alpha is now available. Snort Releases (Feb 25)
• Defense center SnortFan (Feb 25)
  • Re: Defense center Jeremy Hoel (Feb 25)
    • Re: Defense center Richard Harman Jr (rharmanj) (Feb 25)
• Sourcefire VRT Certified Snort Rules Update 2014-02-25 Research (Feb 25)
• Enablesid question SnortFan (Feb 25)
  • Re: Enablesid question Joel Esler (jesler) (Feb 26)
    • Re: Enablesid question SnortFan (Feb 26)
• Opinions about SmoothSec distro containing Snort Jeronimo L. Cabral (Feb 26)
• Sourcefire VRT Certified Snort Rules Update 2014-02-27 Research (Feb 27)
• Fwd: Snort 2.9.6.0 memory leak? Mirek Suliba (Feb 27)
  • Re: Fwd: Snort 2.9.6.0 memory leak? Hui Cao (huica) (Feb 27)
    • Re: Fwd: Snort 2.9.6.0 memory leak? Mirek Suliba (Feb 27)
      • Re: Fwd: Snort 2.9.6.0 memory leak? Hui Cao (huica) (Feb 27)
      • Re: Fwd: Snort 2.9.6.0 memory leak? Mirek Suliba (Feb 27)
      • Re: Fwd: Snort 2.9.6.0 memory leak? waldo kitty (Feb 27)
      • Re: Fwd: Snort 2.9.6.0 memory leak? Mirek Suliba (Feb 27)
      • Re: Fwd: Snort 2.9.6.0 memory leak? Hui Cao (huica) (Feb 28)
      • Re: Fwd: Snort 2.9.6.0 memory leak? Mirek Suliba (Feb 28)
      • Re: Fwd: Snort 2.9.6.0 memory leak? Hui cao (Feb 28)
      • Re: Fwd: Snort 2.9.6.0 memory leak? Mirek Suliba (Feb 28)
• Snort won't generate alerts with single snort.rules file Anacleto Junior (Feb 28)
  • Message not available
    • Re: Snort won't generate alerts with single snort.rules file Anacleto Junior (Mar 06)
      • Re: Snort won't generate alerts with single snort.rules file waldo kitty (Mar 06)
      • Re: Snort won't generate alerts with single snort.rules file Michael Wisniewski (Mar 06)
  • Re: Snort won't generate alerts with single snort.rules file Joel Esler (jesler) (Mar 06)
    • Re: Snort won't generate alerts with single snort.rules file Anacleto Junior (Mar 06)
      • Re: Snort won't generate alerts with single snort.rules file Joel Esler (jesler) (Mar 06)
      • Re: Snort won't generate alerts with single snort.rules file SnortFan (Mar 11)
      • Re: Snort won't generate alerts with single snort.rules file Anacleto Junior (Mar 12)
      • Re: Snort won't generate alerts with single snort.rules file SnortFan (Mar 12)
      • Re: Snort won't generate alerts with single snort.rules file Anacleto Junior (Mar 13)
      • Re: Snort won't generate alerts with single snort.rules file SnortFan (Mar 14)
• AF_Packet module Long, Kerry S (Feb 28)
• Snort IDS Monitoring a Proxy Server with Mode 4 Bonding Turnbough, Bradley E. (Feb 28)
  • Re: Snort IDS Monitoring a Proxy Server with Mode 4 Bonding James Lay (Feb 28)
• TMG Firewall Client long host entry exploit attempt Carlos G Mendioroz (Mar 02)
  • Re: TMG Firewall Client long host entry exploit attempt Joel Esler (jesler) (Mar 02)
    • Re: TMG Firewall Client long host entry exploit attempt Carlos G Mendioroz (Mar 02)
      • Re: TMG Firewall Client long host entry exploit attempt Joel Esler (jesler) (Mar 02)
      • Re: TMG Firewall Client long host entry exploit attempt Carlos G Mendioroz (Mar 03)
      • Re: TMG Firewall Client long host entry exploit attempt Joel Esler (jesler) (Mar 03)
      • Re: TMG Firewall Client long host entry exploit attempt simegnew yihunie (Mar 03)
      • Re: TMG Firewall Client long host entry exploit attempt waldo kitty (Mar 04)
      • Re: TMG Firewall Client long host entry exploit attempt Patrick Mullen (Mar 04)
      • Re: TMG Firewall Client long host entry exploit attempt Carlos G Mendioroz (Mar 04)
      • Re: TMG Firewall Client long host entry exploit attempt Patrick Mullen (Mar 04)
      • Re: TMG Firewall Client long host entry exploit attempt Carlos G Mendioroz (Mar 04)
      • Re: TMG Firewall Client long host entry exploit attempt Randal T. Rioux (Mar 04)
• Snort 2.9.6.0 and number of rules Y M (Mar 02)
  • Re: Snort 2.9.6.0 and number of rules Y M (Mar 06)
    • Re: Snort 2.9.6.0 and number of rules Russ Combs (rucombs) (Mar 06)
      • Re: Snort 2.9.6.0 and number of rules Y M (Mar 26)
• Can't alert on most Michael Wisniewski (Mar 03)
  • Re: Can't alert on most waldo kitty (Mar 04)
    • Re: Can't alert on most Carlos G Mendioroz (Mar 04)
      • Re: Can't alert on most Michael Wisniewski (Mar 04)
      • Re: Can't alert on most waldo kitty (Mar 04)
      • Re: Can't alert on most Carlos G Mendioroz (Mar 05)
      • Re: Can't alert on most Michael Wisniewski (Mar 05)
      • Re: Can't alert on most Doug Burks (Mar 05)
      • Re: Can't alert on most Michael Wisniewski (Mar 05)
      • Re: Can't alert on most Gierczak, Stan (Mar 28)
      • Re: Can't alert on most waldo kitty (Mar 28)
      • Re: Can't alert on most waldo kitty (Mar 05)
• SOHO Pharming sigs Jamie Riden (Mar 04)
• Sourcefire VRT Certified Snort Rules Update 2014-03-04 Research (Mar 04)
• Question - snort v2.9.6.0 rules Eray Balkanli (Mar 04)
  • Re: Question - snort v2.9.6.0 rules Joel Esler (jesler) (Mar 04)
    • Message not available
      • YNT: Question - snort v2.9.6.0 rules Eray Balkanli (Mar 07)
      • İLT: Question - snort v2.9.6.0 rules Eray Balkanli (Mar 09)
      • Re: İLT: Question - snort v2.9.6.0 rules Joel Esler (jesler) (Mar 10)
• Gamut Spambot sig James Lay (Mar 04)
  • Re: Gamut Spambot sig James Lay (Mar 04)
• Regarding set wise pattern matcher sri harsha (Mar 05)
  • Message not available
    • Re: Regarding set wise pattern matcher Hui Cao (huica) (Mar 05)
• order of processing of incoming packets in preprocessors of snort simegnew yihunie (Mar 05)
  • Re: order of processing of incoming packets in preprocessors of snort Hui Cao (huica) (Mar 05)
    • Re: order of processing of incoming packets in preprocessors of snort James Lay (Mar 05)
• Case sensitive fast pattern matches Mike Cox (Mar 05)
  • Re: Case sensitive fast pattern matches Hui Cao (huica) (Mar 05)
  • Re: Case sensitive fast pattern matches waldo kitty (Mar 05)
    • Re: Case sensitive fast pattern matches lists (Mar 05)
• IPS and the alert file Avery Rozar (Mar 05)
• Reputation IP Lists Turnbough, Bradley E. (Mar 05)
  • Re: Reputation IP Lists James Lay (Mar 05)
  • Re: Reputation IP Lists Turnbough, Bradley E. (Mar 05)
• IPS options James Lay (Mar 05)
  • Re: IPS options waldo kitty (Mar 05)
  • Re: IPS options Y M (Mar 05)
    • Re: IPS options James Lay (Mar 06)
      • Re: IPS options Y M (Mar 06)
      • Re: IPS options Russ Combs (rucombs) (Mar 06)
      • Re: IPS options James Lay (Mar 06)
• Getting PF_RING to work on a vanilla driver with Snort Dheeraj Gupta (Mar 06)
• Re: RE : Snort won't generate alerts with single snort.rules file Anacleto Junior (Mar 06)
• Synology Diskstation Manager Reflected XSS sig James Lay (Mar 06)
• IP REP / Pulled Pork / Snort Difficulties Turnbough, Bradley E. (Mar 06)
  • Re: IP REP / Pulled Pork / Snort Difficulties Y M (Mar 06)
    • Re: IP REP / Pulled Pork / Snort Difficulties Anshuman Anil Deshmukh (Mar 07)
      • Re: IP REP / Pulled Pork / Snort Difficulties Y M (Mar 07)
      • Re: IP REP / Pulled Pork / Snort Difficulties Turnbough, Bradley E. (Mar 10)
      • Re: IP REP / Pulled Pork / Snort Difficulties Joel Esler (jesler) (Mar 10)
• Can't find nfq DAQ James Lay (Mar 06)
  • Re: Can't find nfq DAQ James Lay (Mar 07)
• Re: Getting PF_RING to work on a vanilla driver with Snort Dheeraj Gupta (Mar 07)
• [PATCH]: Correctly detect the end of payload in base64_decode Joshua Kinard (Mar 07)
  • Re: [PATCH]: Correctly detect the end of payload in base64_decode Hui Cao (huica) (Mar 07)
    • Re: [PATCH]: Correctly detect the end of payload in base64_decode Joshua Kinard (Mar 07)
      • Re: [PATCH]: Correctly detect the end of payload in base64_decode Hui Cao (huica) (Mar 09)
      • Re: [PATCH]: Correctly detect the end of payload in base64_decode Joshua Kinard (Mar 09)
      • Re: [PATCH]: Correctly detect the end of payload in base64_decode Joel Esler (jesler) (Mar 09)
      • Re: [PATCH]: Correctly detect the end of payload in base64_decode Joshua Kinard (Mar 09)
      • Re: [PATCH]: Correctly detect the end of payload in base64_decode Joel Esler (jesler) (Mar 09)
• home_net as source? Michael Wisniewski (Mar 07)
  • Re: home_net as source? Jeremy Hoel (Mar 07)
    • Re: home_net as source? Turnbough, Bradley E. (Mar 07)
      • Re: home_net as source? Michael Wisniewski (Mar 08)
      • Re: home_net as source? Jeremy Hoel (Mar 08)
• Blocked Verdicts vs. Alerts Avery Rozar (Mar 07)
  • Re: Blocked Verdicts vs. Alerts Joel Esler (jesler) (Mar 07)
    • Re: Blocked Verdicts vs. Alerts Avery Rozar (Mar 07)
      • Re: Blocked Verdicts vs. Alerts Russ Combs (rucombs) (Mar 07)
      • Re: Blocked Verdicts vs. Alerts Avery Rozar (Mar 07)
• Typeset change logs SnortFan (Mar 07)
  • Re: Typeset change logs Y M (Mar 07)
    • Re: Typeset change logs Joel Esler (jesler) (Mar 07)
• Problems Enabling IPQ and NFQ MMartin (Mar 07)
  • Re: Problems Enabling IPQ and NFQ Y M (Mar 07)
  • Re: Problems Enabling IPQ and NFQ Hui cao (Mar 07)
    • Re: Problems Enabling IPQ and NFQ MMartin (Mar 07)
      • Re: Problems Enabling IPQ and NFQ MMartin (Mar 07)
      • Re: Problems Enabling IPQ and NFQ James Lay (Mar 07)
      • Re: Problems Enabling IPQ and NFQ MMartin (Mar 11)
  • <Possible follow-ups>
  • Re: Problems Enabling IPQ and NFQ MMartin (Mar 07)
  • Problems Enabling IPQ and NFQ MMartin (Mar 10)
• New tool: unlimited.py Tony Robinson (Mar 08)
• Copyright assignment on new source files in a patch? Joshua Kinard (Mar 09)
  • Re: Copyright assignment on new source files in a patch? Joel Esler (jesler) (Mar 09)
• overload Snort Michal Šutta (Mar 10)
  • Re: overload Snort Stark, Vernon L. (Mar 10)
• Missing sanity checks in Snort-2.9.7.0-alpha in appid code. Bill Parker (Mar 10)
  • Re: Missing sanity checks in Snort-2.9.7.0-alpha in appid code. Costas Kleopa (ckleopa) (Mar 10)
• Question about CPU affinity for interrupts Roger Campbell (Mar 10)
  • Re: Question about CPU affinity for interrupts Livio Ricciulli (Mar 11)
    • Re: Question about CPU affinity for interrupts Roger Campbell (Mar 11)
      • Re: Question about CPU affinity for interrupts Livio Ricciulli (Mar 11)
• Snort + sfPortscan + Barnyard2 + Snorby Antonio Piepoli (Mar 11)
  • Re: Snort + sfPortscan + Barnyard2 + Snorby waldo kitty (Mar 11)
• Snort error Basant Subba (Mar 11)
  • Re: Snort error lists () packetmail net (Mar 11)
  • Re: Snort error waldo kitty (Mar 11)
• Snort + sfPortscan + Barnyard2 Maxwell, Jamison [HDS] (Mar 11)
  • Re: Snort + sfPortscan + Barnyard2 Antonio Piepoli (Mar 11)
    • Re: Snort + sfPortscan + Barnyard2 Maxwell, Jamison [HDS] (Mar 11)
      • Re: Snort + sfPortscan + Barnyard2 Antonio Piepoli (Mar 11)
      • Re: Snort + sfPortscan + Barnyard2 Maxwell, Jamison [HDS] (Mar 11)
      • Re: Snort + sfPortscan + Barnyard2 Antonio Piepoli (Mar 11)
      • Re: Snort + sfPortscan + Barnyard2 beenph (Mar 11)
      • Re: Snort + sfPortscan + Barnyard2 Antonio Piepoli (Mar 12)
      • Re: Snort + sfPortscan + Barnyard2 beenph (Mar 12)
      • Re: Snort + sfPortscan + Barnyard2 Antonio Piepoli (Mar 12)
• change syslog messages Budinich Galvez, Luis Alberto (Mar 11)
  • Re: change syslog messages MMartin (Mar 11)
  • Re: change syslog messages MMartin (Mar 11)
    • Re: change syslog messages Budinich Galvez, Luis Alberto (Mar 12)
  • Re: change syslog messages waldo kitty (Mar 11)
• Choosing Config detection - search-method Anacleto Junior (Mar 11)
  • Message not available
    • Re: Choosing Config detection - search-method Anacleto Junior (Mar 13)
• Sourcefire VRT Certified Snort Rules Update 2014-03-11 Research (Mar 11)
• Simple rule to match /wp-admin/ Avery Rozar (Mar 11)
• AUTO: AYYILDIZ, Cihan is out of the office. (returning 17.03.2014) Cihan AYYILDIZ (Mar 11)
• hping3 flood detection Meysam Farazmand (Mar 12)
  • Re: hping3 flood detection waldo kitty (Mar 12)
    • Message not available
      • Message not available
      • Message not available
      • Message not available
      • Fwd: Re: hping3 flood detection Meysam Farazmand (Mar 14)
• Snort.org Blog: Open Source Community Webinar Joel Esler (jesler) (Mar 12)
• Snort Services Failed to Start Vona, Steven A CIV NSWCCD Philadelphia, 34117 (Mar 12)
  • Re: Snort Services Failed to Start Joel Esler (jesler) (Mar 12)
    • Re: Snort Services Failed to Start Vona, Steven A CIV NSWCCD Philadelphia, 34117 (Mar 14)
      • Re: Snort Services Failed to Start waldo kitty (Mar 14)
    • Re: Snort Services Failed to Start Vona, Steven A CIV NSWCCD Philadelphia, 34117 (Mar 17)
      • Re: Snort Services Failed to Start Russ Combs (rucombs) (Mar 17)
      • Re: Snort Services Failed to Start Vona, Steven A CIV NSWCCD Philadelphia, 34117 (Mar 17)
      • Re: Snort Services Failed to Start Russ Combs (rucombs) (Mar 17)
      • Re: Snort Services Failed to Start Vona, Steven A CIV NSWCCD Philadelphia, 34117 (Mar 17)
      • Re: Snort Services Failed to Start Russ Combs (rucombs) (Mar 17)
      • Re: Snort Services Failed to Start Vona, Steven A CIV NSWCCD Philadelphia, 34117 (Mar 17)
      • Re: Snort Services Failed to Start Russ Combs (rucombs) (Mar 17)
      • Re: Snort Services Failed to Start Vona, Steven A CIV NSWCCD Philadelphia, 34117 (Mar 17)
      • Re: Snort Services Failed to Start Russ Combs (rucombs) (Mar 17)
      • Re: Snort Services Failed to Start Vona, Steven A CIV NSWCCD Philadelphia, 34117 (Mar 17)
      • Re: Snort Services Failed to Start waldo kitty (Mar 17)
      • Re: Snort Services Failed to Start waldo kitty (Mar 17)
• [snort-devel] Patches to add error checking and replace legacy library calls in 2.9.7.0-alpha Bill Parker (Mar 12)
  • Re: [snort-devel] Patches to add error checking and replace legacy library calls in 2.9.7.0-alpha Costas Kleopa (ckleopa) (Mar 12)
• Problem reading pcap files Bruno Andrade (Mar 12)
• tcpreplay simegnew yihunie (Mar 12)
• Sourcefire VRT Certified Snort Rules Update 2014-03-13 Research (Mar 13)
• [snort-devel] - additional error checking for calls in snort-2.9.7.0-alpha Bill Parker (Mar 13)
  • Re: [snort-devel] - additional error checking for calls in snort-2.9.7.0-alpha Costas Kleopa (ckleopa) (Mar 14)
• patch for spp_normalize.c Gregory S Thomas (Mar 13)
• Lot of errors with duplicated sids C. L. Martinez (Mar 14)
  • Re: Lot of errors with duplicated sids Joel Esler (jesler) (Mar 14)
    • Re: Lot of errors with duplicated sids C. L. Martinez (Mar 14)
• [Webinar-2014_03_14] ARF or WRF files Emiliano Fausto (Mar 14)
  • Re: [Webinar-2014_03_14] ARF or WRF files Joel Esler (jesler) (Mar 14)
    • Re: [Webinar-2014_03_14] ARF or WRF files Emiliano Fausto (Mar 14)
• Sniffing Bonded Ports (Linux, mode=4) Turnbough, Bradley E. (Mar 14)
• Unexpected results with reputation preprocessor Dave Corsello (Mar 15)
  • Re: Unexpected results with reputation preprocessor Dave Corsello (Mar 19)
    • Re: Unexpected results with reputation preprocessor Joel Esler (jesler) (Mar 19)
      • Re: Unexpected results with reputation preprocessor James Lay (Mar 19)
      • Re: Unexpected results with reputation preprocessor Dave Corsello (Mar 19)
      • Re: Unexpected results with reputation preprocessor Dave Corsello (Mar 19)
      • Re: Unexpected results with reputation preprocessor James Lay (Mar 19)
      • Re: Unexpected results with reputation preprocessor Dave Corsello (Mar 19)
      • Re: Unexpected results with reputation preprocessor Joel Esler (jesler) (Mar 19)
      • Re: Unexpected results with reputation preprocessor Dave Corsello (Mar 19)
      • Re: Unexpected results with reputation preprocessor Joel Esler (jesler) (Mar 19)
• Whitelist port? Michael Wisniewski (Mar 16)
• Sourcefire VRT Certified Snort Rules Update 2014-03-18 Research (Mar 18)
• Snort Inline mode with iptables problems on Ubuntu 12.04 Shiva (Mar 19)
  • Re: Snort Inline mode with iptables problems on Ubuntu 12.04 Shivaramakrishnan Vaidyanathan (Mar 19)
  • Re: Snort Inline mode with iptables problems on Ubuntu 12.04 James Lay (Mar 19)
    • Re: Snort Inline mode with iptables problems on Ubuntu 12.04 Shivaramakrishnan Vaidyanathan (Mar 19)
      • Re: Snort Inline mode with iptables problems on Ubuntu 12.04 James Lay (Mar 19)
      • Re: Snort Inline mode with iptables problems on Ubuntu 12.04 Shivaramakrishnan Vaidyanathan (Mar 19)
      • Re: Snort Inline mode with iptables problems on Ubuntu 12.04 Shivaramakrishnan Vaidyanathan (Mar 19)
      • Re: Snort Inline mode with iptables problems on Ubuntu 12.04 James Lay (Mar 19)
      • Re: Snort Inline mode with iptables problems on Ubuntu 12.04 Shivaramakrishnan Vaidyanathan (Mar 19)
      • Re: Snort Inline mode with iptables problems on Ubuntu 12.04 James Lay (Mar 19)
• output alert_fast: is not anymore a pipe? Juan Camilo Valencia (Mar 19)
  • Re: output alert_fast: is not anymore a pipe? Juan Camilo Valencia (Mar 21)
    • Re: output alert_fast: is not anymore a pipe? Russ Combs (rucombs) (Mar 21)
• SNORT daq modules question Shivaramakrishnan Vaidyanathan (Mar 19)
• getting a full copy of pcap for forensic purposes from Snort Long, Kerry S (Mar 20)
  • Re: getting a full copy of pcap for forensic purposes from Snort Joel Esler (jesler) (Mar 20)
  • <Possible follow-ups>
  • Re: getting a full copy of pcap for forensic purposes from Snort Y M (Mar 20)
    • Message not available
      • Re: getting a full copy of pcap for forensic purposes from Snort Y M (Mar 20)
• Re: getting a full copy of pcap for forensic purpose from Snort Long, Kerry S (Mar 20)
  • Re: getting a full copy of pcap for forensic purpose from Snort Jeremy Hoel (Mar 20)
• Snort 2.9.6 Configuration Nanda Vardhan (Mar 20)
  • <Possible follow-ups>
  • Re: Snort 2.9.6 Configuration Mitesh Jadia (Mar 20)
• Sourcefire VRT Certified Snort Rules Update 2014-03-20 Research (Mar 20)
• Sending alerts by email in real-time Jeronimo L. Cabral (Mar 20)
  • Re: Sending alerts by email in real-time Doug Burks (Mar 20)
• Detect Credit Card number in attached file hosein izadi (Mar 20)
  • Re: Detect Credit Card number in attached file Russ Combs (rucombs) (Mar 20)
    • Re: Detect Credit Card number in attached file hosein izadi (Mar 21)
      • Re: Detect Credit Card number in attached file Russ Combs (rucombs) (Mar 21)
      • Re: Detect Credit Card number in attached file hosein izadi (Mar 21)
      • Re: Detect Credit Card number in attached file Russ Combs (rucombs) (Mar 24)
      • Re: Detect Credit Card number in attached file hosein izadi (Mar 24)
      • Re: Detect Credit Card number in attached file Russ Combs (rucombs) (Mar 27)
      • Re: Detect Credit Card number in attached file hosein izadi (Mar 27)
      • Re: Detect Credit Card number in attached file Russ Combs (rucombs) (Mar 27)
      • Re: Detect Credit Card number in attached file hosein izadi (Mar 31)
      • Re: Detect Credit Card number in attached file Russ Combs (rucombs) (Mar 31)
• Snort 2.9.6.0 Packet Capturing Nanda Vardhan (Mar 20)
• Subj: [snort-devel] lack of sanity checks for strdup/strndup() calls in 2.9.7.0-alpha Bill Parker (Mar 20)
  • Re: Subj: [snort-devel] lack of sanity checks for strdup/strndup() calls in 2.9.7.0-alpha Costas Kleopa (ckleopa) (Mar 21)
• DRPA dataset basant subba (Mar 20)
  • Re: DRPA dataset Joel Esler (jesler) (Mar 21)
• Snort-2.9.6.0 Packet Capturing Nanda Vardhan (Mar 21)
  • Re: Snort-2.9.6.0 Packet Capturing Joel Esler (jesler) (Mar 21)
    • Re: Snort-2.9.6.0 Packet Capturing Nanda Vardhan (Mar 22)
      • Re: Snort-2.9.6.0 Packet Capturing praveen_recker . (Mar 22)
      • Re: Snort-2.9.6.0 Packet Capturing Tony Robinson (Mar 22)
      • Re: Snort-2.9.6.0 Packet Capturing Anacleto Junior (Mar 23)
      • Re: Snort-2.9.6.0 Packet Capturing praveen_recker . (Mar 23)
      • Snort-2.9.6.0 Packet Capturing Nanda Vardhan (Mar 22)
      • Re: Snort-2.9.6.0 Packet Capturing Y M (Mar 26)
• Order of stream_size and dsize checks? Harley H (Mar 21)
  • Re: Order of stream_size and dsize checks? Steven Sturges (Mar 21)
    • Re: Order of stream_size and dsize checks? Joel Esler (jesler) (Mar 21)
      • Re: Order of stream_size and dsize checks? snort user (Mar 21)
      • Re: Order of stream_size and dsize checks? Steven Sturges (Mar 21)
      • Re: Order of stream_size and dsize checks? Joel Esler (jesler) (Mar 21)
      • Re: Order of stream_size and dsize checks? Joshua Kinard (Mar 21)
• Order of Preprocessors Tony Robinson (Mar 21)
  • Re: Order of Preprocessors Y M (Mar 26)
• CMD override HOME_NET Balasubramaniam Natarajan (Mar 21)
• Packet Capturing Nanda Vardhan (Mar 23)
  • Re: Packet Capturing Russ Combs (rucombs) (Mar 24)
• Inline direction question for rules to work best Avery Rozar (Mar 23)
• HELP! stephanie sokhn (Mar 23)
  • Re: HELP! James Lay (Mar 24)
  • <Possible follow-ups>
  • Re: HELP! James Lay (Mar 24)
• event_filter by IP? William Rehnquyst (Mar 24)
  • Re: event_filter by IP? Nicholas Mavis (nmavis) (Mar 25)
  • Re: event_filter by IP? Nicholas Mavis (nmavis) (Mar 25)
    • Re: event_filter by IP? William Rehnquyst (Mar 27)
• Action based on certain event Turnbough, Bradley E. (Mar 24)
  • Re: Action based on certain event Turnbough, Bradley E. (Mar 24)
• Snort rules with openAppId feature Guillaume DALEUX (Mar 24)
• c0c0n 2014 | The cy0ps c0n - Call For Papers & Call For Workshops c0c0n International Information Security Conference (Mar 24)
• Sourcefire VRT Certified Snort Rules Update 2014-03-25 Research (Mar 25)
• Snort as a HIPS James Lay (Mar 25)
  • Re: Snort as a HIPS Dave Corsello (Mar 25)
    • Re: Snort as a HIPS James Lay (Mar 25)
• Adding "drop" in the msg output. Avery Rozar (Mar 26)
  • Re: Adding "drop" in the msg output. Joel Esler (jesler) (Mar 26)
    • Re: Adding "drop" in the msg output. Jeremy Hoel (Mar 26)
    • Re: Adding "drop" in the msg output. Avery Rozar (Mar 27)
• Basic snort setup for processing pcap produces no alerts Egon Kidmose (Mar 26)
  • Re: Basic snort setup for processing pcap produces no alerts James Lay (Mar 26)
  • Message not available
    • Re: Basic snort setup for processing pcap produces no alerts Egon Kidmose (Mar 27)
• RE : Basic snort setup for processing pcap produces no alerts rmkml (Mar 26)
• ignore dhcp traffic from modem/router Philip Beattie (Mar 26)
  • Re: ignore dhcp traffic from modem/router Jeremy Hoel (Mar 26)
• Pulledpork and sid-msg.map Avery Rozar (Mar 26)
  • Re: Pulledpork and sid-msg.map Jeremy Hoel (Mar 26)
    • Re: Pulledpork and sid-msg.map Avery Rozar (Mar 26)
      • Re: Pulledpork and sid-msg.map Jeremy Hoel (Mar 26)
      • Re: Pulledpork and sid-msg.map Avery Rozar (Mar 26)
• Encoded Rule Plugin SID: 16329, GID: 3 not registered properly. Disabling this rule. Vona, Steven A CIV NSWCCD Philadelphia, 34117 (Mar 26)
  • Re: Encoded Rule Plugin SID: 16329, GID: 3 not registered properly. Disabling this rule. Y M (Mar 26)
• unified2 - multiple events and single packet question Jeff Sundquist (Mar 26)
  • Re: unified2 - multiple events and single packet question Jeff Sundquist (Mar 26)
    • Re: unified2 - multiple events and single packet question Joel Esler (jesler) (Mar 26)
• What does Snort stand for? Josh Bitto (Mar 26)
  • Re: What does Snort stand for? Joel Esler (jesler) (Mar 26)
• Snort limitations Ayoub Abid (Mar 27)
  • Re: Snort limitations Nicholas Mavis (nmavis) (Mar 27)
    • Re: Snort limitations Stark, Vernon L. (Mar 27)
      • Re: Snort limitations Nicholas Mavis (nmavis) (Mar 28)
  • <Possible follow-ups>
  • Re: Snort Limitations Maxwell, Jamison [HDS] (Mar 28)
• Snort Event Types Turnbough, Bradley E. (Mar 27)
  • Re: Snort Event Types Dave Corsello (Mar 27)
    • Re: Snort Event Types James Lay (Mar 27)
• Sourcefire VRT Certified Snort Rules Update 2014-03-27 Research (Mar 27)
• God of No Mercy Lee Kuan Yew and Teo En Ming Singapore Citizen Mr. Teo En Ming (Zhang Enming) (Mar 27)
• Diff between max_queue and log (README.event_queue) Balasubramaniam Natarajan (Mar 27)
  • Re: Diff between max_queue and log (README.event_queue) Joel Esler (jesler) (Mar 27)
  • Re: Diff between max_queue and log (README.event_queue) Nicholas Mavis (nmavis) (Mar 27)
• Neutralization of an IPS stephanie sokhn (Mar 27)
• Invalid login attempts Anshuman Anil Deshmukh (Mar 27)
  • Re: Invalid login attempts Anshuman Anil Deshmukh (Mar 31)
• [SNORT-DEVEL] Additional Credit/Debit Card Tracking Capability for 2.9.7.0-Alpha Bill Parker (Mar 27)
  • Re: [SNORT-DEVEL] Additional Credit/Debit Card Tracking Capability for 2.9.7.0-Alpha Josh Rosenbaum (jrosenba) (Mar 28)
• Segmentation fault while reloading configuration Hugo Vasconcelos Saldanha (Mar 27)
  • Re: Segmentation fault while reloading configuration Josh Rosenbaum (jrosenba) (Mar 28)
• Re: Encoded Rule Plugin SID: 16329, GID: 3 not registered properly. Disabling this rule. Vona, Steven A CIV NSWCCD Philadelphia, 34117 (Mar 28)
  • Re: Encoded Rule Plugin SID: 16329, GID: 3 not registered properly. Disabling this rule. waldo kitty (Mar 28)
• ERSPAN Fernando Cardoso (Mar 28)
  • Re: ERSPAN Russ Combs (rucombs) (Mar 31)
    • Re: ERSPAN Fernando Cardoso (Mar 31)
• Error 403 when downloading rules with pulledpork Joe Evango (Mar 28)
  • Re: Error 403 when downloading rules with pulledpork Joel Esler (jesler) (Mar 28)
• Question about xls trigger SnortFan (Mar 28)
  • Re: Question about xls trigger James Lay (Mar 28)
  • Re: Question about xls trigger Joel Esler (jesler) (Mar 28)
    • Re: Question about xls trigger SnortFan (Mar 28)
      • Re: Question about xls trigger Joel Esler (jesler) (Mar 28)
• [SNORT-DEVEL] iban.c/iban.h code for possible use in snort-2.9.7.0-alpha Bill Parker (Mar 28)
• Port mirroring settings for SNORT basant subba (Mar 28)
  • Re: Port mirroring settings for SNORT waldo kitty (Mar 28)
  • Re: Port mirroring settings for SNORT Kevin Ross (Mar 31)
• Snorby Snort or Barnyard scrambles IPs Ilja Schumacher (Mar 31)
  • Re: Snorby Snort or Barnyard scrambles IPs Jeremy Hoel (Mar 31)
• Exception to a rule pulled by pulledpork Ilja Schumacher (Mar 31)
  • Re: Exception to a rule pulled by pulledpork Jeremy Hoel (Mar 31)
  • Re: Exception to a rule pulled by pulledpork waldo kitty (Mar 31)
• running more instances of snort Michal Šutta (Mar 31)
  • Re: running more instances of snort James Lay (Mar 31)
  • Re: running more instances of snort Livio Ricciulli (Mar 31)
    • Re: running more instances of snort Michal Šutta (Mar 31)
      • Re: running more instances of snort Russ Combs (rucombs) (Mar 31)
      • Re: running more instances of snort Jeremy Hoel (Mar 31)
      • Re: running more instances of snort Michal Šutta (Mar 31)

Previous period

Next period