Snort: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

501 messages starting Jan 03 16 and ending Mar 31 16
Date index | Thread index | Author index

• Re: Re Rule SID 15451 Patrick Mullen (Jan 03)
• (no subject) Aurimas Rudinskis (Jan 04)
  • Re: (no subject) Russ (Jan 04)
    • Re: (no subject) Aurimas Rudinskis (Jan 04)
• Re: Snort-users Digest, Vol 116, Issue 1 Carlos Rodriguez Hernandez (Jan 05)
• Snort Subscriber Rules Update 2016-01-05 Research (Jan 05)
• Disabled Rules Spencer Brewer (Jan 07)
  • Re: Disabled Rules JJC (Jan 07)
• Snort Subscriber Rules Update 2016-01-07 Research (Jan 07)
• Re: pop: Unknown POP3 response/command Matteo De Rosa (Jan 08)
  • <Possible follow-ups>
  • Re: pop: Unknown POP3 response/command Matteo De Rosa (Jan 11)
    • Re: [WARNING : A/V UNSCANNABLE] Re: pop: Unknown POP3 response/command Al Lewis (allewi) (Jan 11)
      • pop: Unknown POP3 response/command Matteo De Rosa (Jan 12)
      • Re: Unknown POP3 response/command Al Lewis (allewi) (Jan 12)
      • capture traffic Matteo De Rosa (Jan 12)
      • Re: Unknown POP3 response/command Matteo De Rosa (Jan 13)
• use wget to download community.rules file Lamont, Brian A. (Jan 08)
  • Re: use wget to download community.rules file James Lay (Jan 08)
• Security Ruleset - CVSS Level Vaughn A. Hart (Jan 09)
  • Re: Security Ruleset - CVSS Level Joel Esler (jesler) (Jan 09)
    • Re: Security Ruleset - CVSS Level Joel Esler (jesler) (Jan 11)
      • Re: Security Ruleset - CVSS Level Joel Esler (jesler) (Jan 11)
• Re: Snort-sigs Digest, Vol 116, Issue 4 Vaughn A. Hart (Jan 11)
• Alert from Internal Net as Attacker Giuseppe Morici (Jan 12)
  • Re: Alert from Internal Net as Attacker Al Lewis (allewi) (Jan 12)
    • R: Alert from Internal Net as Attacker Giuseppe Morici (Jan 12)
      • Re: Alert from Internal Net as Attacker Al Lewis (allewi) (Jan 12)
      • Re: Alert from Internal Net as Attacker Alan Gao (Jan 12)
      • Re: Alert from Internal Net as Attacker Joel Esler (jesler) (Jan 12)
      • Re: Alert from Internal Net as Attacker Joel Esler (jesler) (Jan 12)
• Logging 5 packets for all rule match OrgacK (Jan 12)
• Snort Subscriber Rules Update 2016-01-12 Research (Jan 12)
• Can Snort Analyze Sampled Netflow Traffic Hanan Shteingart (Jan 13)
  • Re: Can Snort Analyze Sampled Netflow Traffic Emiliano Fausto (Jan 13)
    • Re: Can Snort Analyze Sampled Netflow Traffic Hanan Shteingart (Jan 13)
      • Re: Can Snort Analyze Sampled Netflow Traffic Joel Esler (jesler) (Jan 13)
      • Re: Can Snort Analyze Sampled Netflow Traffic Hanan Shteingart (Jan 13)
      • Re: Can Snort Analyze Sampled Netflow Traffic Joel Esler (jesler) (Jan 13)
      • Re: Can Snort Analyze Sampled Netflow Traffic Hanan Shteingart (Jan 13)
      • Re: Can Snort Analyze Sampled Netflow Traffic Joel Esler (jesler) (Jan 13)
      • Re: Can Snort Analyze Sampled Netflow Traffic Emiliano Fausto (Jan 13)
      • Re: Can Snort Analyze Sampled Netflow Traffic Hanan Shteingart (Jan 13)
      • Re: Can Snort Analyze Sampled Netflow Traffic Emiliano Fausto (Jan 13)
• Snort Subscriber Rules Update 2016-01-14 Research (Jan 14)
• Rule triggers on every request Michael Kjeldsen (Jan 14)
• Error in log file of Snort Ajay Khadpe (Jan 15)
  • Fwd: Error in log file of Snort Ajay Khadpe (Jan 15)
• [HITB-Announce] #HITB2016AMS Capture the Flag: Culinary Tour de Force - Registration now open Hafez Kamal (Jan 15)
  • Re: [HITB-Announce] #HITB2016AMS Capture the Flag: Culinary Tour de Force - Registration now open Ronald Hill (Jan 15)
    • Re: [HITB-Announce] #HITB2016AMS Capture the Flag: Culinary Tour de Force - Registration now open Al Lewis (allewi) (Jan 16)
• Installation Guide To Pulled Pork, Barnyard2 and Snorby Okinda Ragwar (Jan 17)
  • Re: Installation Guide To Pulled Pork, Barnyard2 and Snorby Joel Esler (jesler) (Jan 19)
• Re: Snort-devel Digest, Vol 114, Issue 2 rahul yadav (Jan 18)
• help with file bpf and ip 0.0.0.0 hernani coelho (Jan 18)
  • <Possible follow-ups>
  • Re: help with file bpf and ip 0.0.0.0 hernani coelho (Jan 20)
    • Re: help with file bpf and ip 0.0.0.0 James Lay (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 hernani coelho (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 hernani coelho (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 hernani coelho (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 hernani coelho (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 Al Lewis (allewi) (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 hernani coelho (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 wkitty42 (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 Al Lewis (allewi) (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 wkitty42 (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 hernani coelho (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 Joel Esler (jesler) (Jan 20)
      • Re: help with file bpf and ip 0.0.0.0 hernani coelho (Jan 21)
      • Re: help with file bpf and ip 0.0.0.0 hernani coelho (Jan 21)
      • Re: help with file bpf and ip 0.0.0.0 Joel Esler (jesler) (Jan 21)
      • Re: help with file bpf and ip 0.0.0.0 hernani coelho (Feb 12)
      • Re: help with file bpf and ip 0.0.0.0 Al Lewis (allewi) (Feb 12)
    • Re: help with file bpf and ip 0.0.0.0 Joel Esler (jesler) (Jan 20)
• [OT] Release: check_ids_interfaces Nagios plugin Darren S. (Jan 18)
• Issue with snort version arun sharma (Jan 18)
  • Re: Issue with snort version Joel Esler (jesler) (Jan 19)
• MALWARE-CNC Win.Trojan.Bedep variant outbound connection (1:33188) Elliot Anderson (Jan 19)
  • Re: MALWARE-CNC Win.Trojan.Bedep variant outbound connection (1:33188) rmkml (Jan 19)
  • Re: MALWARE-CNC Win.Trojan.Bedep variant outbound connection (1:33188) Joel Esler (jesler) (Jan 19)
    • Re: MALWARE-CNC Win.Trojan.Bedep variant outbound connection (1:33188) Elliot Anderson (Jan 19)
  • Re: MALWARE-CNC Win.Trojan.Bedep variant outbound connection (1:33188) Alex McDonnell (Jan 19)
    • Re: MALWARE-CNC Win.Trojan.Bedep variant outbound connection (1:33188) Elliot Anderson (Jan 20)
• snort crash in DecodeTCP hung quy (Jan 19)
  • Re: snort crash in DecodeTCP Joel Esler (jesler) (Jan 19)
• Snort Subscriber Rules Update 2016-01-19 Research (Jan 19)
• CVE-2016-0728 Elliot Anderson (Jan 19)
  • Re: CVE-2016-0728 Joel Esler (jesler) (Jan 20)
    • Re: CVE-2016-0728 Elliot Anderson (Jan 20)
      • Re: CVE-2016-0728 Joel Esler (jesler) (Jan 20)
      • Re: CVE-2016-0728 Elliot Anderson (Jan 20)
      • Re: CVE-2016-0728 Joel Esler (jesler) (Jan 21)
• File-inspect test automation framework and related issues Vladimir Kunschikov (Jan 20)
  • Re: File-inspect test automation framework and related issues Russ (Jan 25)
    • Re: File-inspect test automation framework and related issues Hui Cao (huica) (Jan 25)
      • Re: File-inspect test automation framework and related issues Vladimir Kunschikov (Jan 25)
• [HITB-Announce] #HITB2016AMS CFP Closes in < 3 Weeks Hafez Kamal (Jan 21)
• Snort GUI install (barnyard2 & pulled pork install guides for the needy) Okinda Ragwar (Jan 21)
  • Re: Snort GUI install (barnyard2 & pulled pork install guides for the needy) Joel Esler (jesler) (Jan 21)
  • Re: Snort GUI install (barnyard2 & pulled pork install guides for the needy) Robin Kipp (Jan 21)
• Snort running inline but not functioning as IPS Robin Kipp (Jan 21)
  • Re: Snort running inline but not functioning as IPS James Lay (Jan 21)
    • Re: Snort running inline but not functioning as IPS Robin Kipp (Jan 21)
      • Re: Snort running inline but not functioning as IPS James Lay (Jan 21)
      • Re: Snort running inline but not functioning as IPS mlists (Jan 22)
      • Re: Snort running inline but not functioning as IPS Joel Esler (jesler) (Jan 22)
      • Re: Snort running inline but not functioning as IPS Robin Kipp (Jan 22)
      • Re: Snort running inline but not functioning as IPS Joel Esler (jesler) (Jan 22)
      • Re: Snort running inline but not functioning as IPS Robin Kipp (Jan 23)
      • Re: Snort running inline but not functioning as IPS Joel Esler (jesler) (Jan 23)
      • Re: Snort running inline but not functioning as IPS Robin Kipp (Jan 24)
      • Re: Snort running inline but not functioning as IPS Y M (Jan 24)
      • Re: Snort running inline but not functioning as IPS Robin Kipp (Jan 24)
      • Re: Snort running inline but not functioning as IPS Y M (Jan 24)
      • Re: Snort running inline but not functioning as IPS Robin Kipp (Jan 26)
      • Re: Snort running inline but not functioning as IPS Y M (Jan 27)
      • Re: Snort running inline but not functioning as IPS Robin Kipp (Jan 27)
      • Re: Snort running inline but not functioning as IPS Y M (Jan 27)
      • Re: Snort running inline but not functioning as IPS Robin Kipp (Jan 27)
• direction issue with 37053 John Ives (Jan 21)
  • Re: direction issue with 37053 Joel Esler (jesler) (Jan 21)
  • Re: direction issue with 37053 Joel Esler (jesler) (Jan 21)
  • Re: direction issue with 37053 Joel Esler (jesler) (Jan 22)
• Always logging as binary! Jack Rief (Jan 21)
  • Re: Always logging as binary! Joel Esler (jesler) (Jan 21)
    • Re: Always logging as binary! Jack Rief (Jan 22)
      • Re: Always logging as binary! wkitty42 (Jan 22)
      • Re: Always logging as binary! Joel Esler (jesler) (Jan 22)
• what is the command line to use ignore.rules - pass ip hernani coelho (Jan 22)
  • Re: what is the command line to use ignore.rules - pass ip hernani coelho (Jan 22)
    • Re: what is the command line to use ignore.rules - pass ip Al Lewis (allewi) (Jan 22)
      • Re: what is the command line to use ignore.rules - pass ip hernani coelho (Jan 22)
      • Re: what is the command line to use ignore.rules - pass ip Al Lewis (allewi) (Jan 22)
      • Re: what is the command line to use ignore.rules - pass ip hernani coelho (Jan 22)
      • Re: what is the command line to use ignore.rules - pass ip hernani coelho (Jan 22)
      • Re: what is the command line to use ignore.rules - pass ip hernani coelho (Jan 22)
      • Re: what is the command line to use ignore.rules - pass ip Al Lewis (allewi) (Jan 22)
      • Re: what is the command line to use ignore.rules - pass ip Al Lewis (allewi) (Jan 22)
      • Message not available
      • Re: what is the command line to use ignore.rules - pass ip Al Lewis (allewi) (Jan 22)
      • Re: what is the command line to use ignore.rules - pass ip hernani coelho (Jan 25)
      • Re: what is the command line to use ignore.rules - pass ip wkitty42 (Jan 25)
      • Re: what is the command line to use ignore.rules - pass ip hernani coelho (Jan 25)
      • Re: what is the command line to use ignore.rules - pass ip hernani coelho (Feb 12)
• Unified 2 not working. I need help. Matthew White (Jan 22)
  • Re: Unified 2 not working. I need help. Avery Rozar (Jan 22)
    • Re: Unified 2 not working. I need help. Matthew White (Jan 22)
      • Re: Unified 2 not working. I need help. James Lay (Jan 22)
      • Re: Unified 2 not working. I need help. Matthew White (Jan 22)
      • Re: Unified 2 not working. I need help. James Lay (Jan 23)
      • Re: Unified 2 not working. I need help. Matthew White (Jan 25)
      • Re: Unified 2 not working. I need help. James Lay (Jan 25)
      • Re: Unified 2 not working. I need help. Matthew White (Jan 27)
      • Re: Unified 2 not working. I need help. James Lay (Jan 28)
      • Re: Unified 2 not working. I need help. Matthew White (Jan 29)
      • Re: Unified 2 not working. I need help. Matthew White (Jan 29)
      • Re: Unified 2 not working. I need help. Matthew White (Feb 01)
      • Re: Unified 2 not working. I need help. Matthew White (Jan 29)
      • Re: Unified 2 not working. I need help. Matthew White (Jan 29)
• how can i stop alerts from 64.4.8.0 or 64.4.8.1 hernani coelho (Jan 24)
• sid-msg.map can not be located Andrew g (Jan 24)
  • Re: sid-msg.map can not be located Y M (Jan 24)
    • Re: sid-msg.map can not be located Andrew g (Jan 24)
      • Re: sid-msg.map can not be located wkitty42 (Jan 24)
• attack responses euid=0(root) u (Jan 24)
• Re: preprocessor stream5_global prune_log_max 0 elof (Jan 25)
  • Re: preprocessor stream5_global prune_log_max 0 elof (Jan 25)
• Re: Large Packet Drop with SNort-2.9.80 as compared to Snort-2.9.7.6 elof (Jan 25)
• Snort performance via bfp filters on +20gbps network traffic Txalin (Jan 25)
• Compilation error when disabling performance profiling (Snort 2.9.8.0) (UNCLASSIFIED) Knick, Scott E CTR (US) (Jan 25)
  • Re: Compilation error when disabling performance profiling (Snort 2.9.8.0) (UNCLASSIFIED) Ed Borgoyn (eborgoyn) (Jan 25)
• Linux distro for Snort inline as IPS Sec_Aficiondado (Jan 25)
  • Re: Linux distro for Snort inline as IPS James Lay (Jan 25)
    • Re: Linux distro for Snort inline as IPS Jeff H (Jan 25)
      • Re: Linux distro for Snort inline as IPS wkitty42 (Jan 26)
      • Re: Linux distro for Snort inline as IPS Avery Rozar (Jan 26)
      • Re: Linux distro for Snort inline as IPS Sec_Aficiondado (Jan 26)
• Snort 2.9.8.0 can't detect hits over fragmented packets using multiple policies Jon Larson (Jan 25)
  • Re: Snort 2.9.8.0 can't detect hits over fragmented packets using multiple policies Ed Borgoyn (eborgoyn) (Jan 29)
    • Re: Snort 2.9.8.0 can't detect hits over fragmented packets using multiple policies Jon Larson (Jan 29)
• [ASK] Snort not dropping all packet Soni Setiawan (Jan 25)
• Snort Subscriber Rules Update 2016-01-26 Research (Jan 26)
• Quest for the Holy Grail (A Snort GUI) Okinda Ragwar (Jan 26)
  • Re: Quest for the Holy Grail (A Snort GUI) Michael Steele (Jan 26)
• Snort error in windows Thomas Bey (Jan 26)
• Conflict with pfring Robert Lasota (Jan 27)
  • Re: Conflict with pfring Y M (Jan 27)
• sfportscan not detecting my scans Bassman Rod (Jan 27)
• Snort Subscriber Rules Update 2016-01-28 Research (Jan 28)
• Interested in Snort for cloud? are you Intel employee? Choma, Yaron (Jan 28)
  • Re: Interested in Snort for cloud? are you Intel employee? Russ (Jan 28)
• Odp: Re: Conflict with pfring Robert Lasota (Jan 28)
• sfportscan Bassman Rod (Jan 28)
  • Re: sfportscan Al Lewis (allewi) (Jan 29)
    • Re: sfportscan Al Lewis (allewi) (Jan 29)
• Snort Subscriber Rules Update 2016-02-02 Research (Feb 02)
• barnyard2 will not start Gilbert, Sonia M CTR (US) (Feb 02)
• SOLVED Unified 2 not working. I need help. Matthew White (Feb 02)
• Snort IP blacklist issue (Pulledprok) Nicolas Lepolard (Feb 03)
  • Re: Snort IP blacklist issue (Pulledprok) Shirkdog (Feb 03)
    • Re: Snort IP blacklist issue (Pulledprok) Nicolas Lepolard (Feb 04)
      • Re: Snort IP blacklist issue (Pulledprok) Shirkdog (Feb 04)
      • Re: Snort IP blacklist issue (Pulledprok) Nicolas Lepolard (Feb 04)
      • Re: Snort IP blacklist issue (Pulledprok) Shirkdog (Feb 04)
      • Fwd: Re: Snort IP blacklist issue (Pulledprok) wkitty42 (Feb 04)
      • Re: Fwd: Re: Snort IP blacklist issue (Pulledprok) Shirkdog (Feb 04)
      • Re: Fwd: Re: Snort IP blacklist issue (Pulledprok) Nicolas Lepolard (Feb 05)
      • Re: Fwd: Re: Snort IP blacklist issue (Pulledprok) wkitty42 (Feb 05)
      • Re: Fwd: Re: Snort IP blacklist issue (Pulledprok) Shirkdog (Feb 05)
      • Re: Fwd: Re: Snort IP blacklist issue (Pulledprok) Nicolas Lepolard (Feb 22)
• Snorby Setup help - ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' Matthew White (Feb 03)
• barnyard2 and Chef Izz Noland (Feb 03)
  • Message not available
    • Re: barnyard2 and Chef Izz Noland (Feb 03)
• Performance issue in 2.9.8.0 Phillip Deneault (Feb 04)
  • Re: Performance issue in 2.9.8.0 Hui cao (Feb 04)
• Problem with custom preprocessor - FLAG_STREAM_INSERT set in all packets Arun Koshal (Feb 04)
  • Re: Problem with custom preprocessor - FLAG_STREAM_INSERT set in all packets Arun Koshal (Feb 04)
• Snort Subscriber Rules Update 2016-02-04 Research (Feb 04)
• Redundant call to fseek() in u2spewfoo.cc in Snort-3.0.0a3/a4 Bill Parker (Feb 04)
• Potential NULL pointer dereference in Snort-3.0.0a3/a4 (CWE-476) Bill Parker (Feb 04)
• Snort 2.9.8.0 no --enable-zlib option Gilbert, Sonia M CTR (US) (Feb 04)
  • <Possible follow-ups>
  • Re: Snort 2.9.8.0 no --enable-zlib option Gilbert, Sonia M CTR (US) (Feb 04)
    • Re: [Non-DoD Source] Re: Snort 2.9.8.0 no --enable-zlib option Gilbert, Sonia M CTR (US) (Feb 04)
  • Re: Snort 2.9.8.0 no --enable-zlib option Ed Borgoyn (eborgoyn) (Feb 05)
• Doubts ARUN LAL (Feb 08)
  • Re: Doubts wkitty42 (Feb 08)
  • <Possible follow-ups>
  • Doubts ARUN LAL (Feb 10)
    • Re: Doubts wkitty42 (Feb 10)
      • Message not available
      • Re: [Snort-users] Doubts ARUN LAL (Feb 11)
      • Re: [Snort-users] Doubts wkitty42 (Feb 16)
  • Doubts ARUN LAL (Feb 10)
    • Re: Doubts Al Lewis (allewi) (Feb 10)
  • Doubts ARUN LAL (Feb 10)
    • Re: Doubts wkitty42 (Feb 10)
      • Re: Doubts ARUN LAL (Feb 11)
      • Re: Doubts stefan (Feb 11)
      • Re: Doubts wkitty42 (Feb 11)
      • Re: Doubts ARUN LAL (Feb 11)
• How to enable ALL rules when Pulledpork is ran? Michael Steele (Feb 08)
  • Re: How to enable ALL rules when Pulledpork is ran? Y M (Feb 08)
    • Re: How to enable ALL rules when Pulledpork is ran? Shirkdog (Feb 08)
    • Re: How to enable ALL rules when Pulledpork is ran? Michael Steele (Feb 08)
• Using PCRE in ICMP header adrien le jol (Feb 09)
• Snort Subscriber Rules Update 2016-02-09 Research (Feb 09)
• Known Diskspace utilization issues Matthew Smith (Feb 09)
• Snort Subscriber Rules Update 2016-02-11 Research (Feb 11)
• CVE-2016-1287 Elliot Anderson (Feb 11)
  • Re: CVE-2016-1287 Joel Esler (jesler) (Feb 11)
    • Re: CVE-2016-1287 James Lay (Feb 11)
      • Re: CVE-2016-1287 Y M (Feb 11)
      • Re: CVE-2016-1287 James Lay (Feb 11)
    • Re: CVE-2016-1287 Elliot Anderson (Feb 11)
      • Re: CVE-2016-1287 Joel Esler (jesler) (Feb 11)
      • Re: CVE-2016-1287 Elliot Anderson (Feb 11)
• Re: Snort-sigs Digest, Vol 117, Issue 3 Alex McDonnell (Feb 11)
• snort-snorby connection ARUN LAL (Feb 12)
• Snort++ Build 186 Available Now Snort Releases (Feb 12)
  • <Possible follow-ups>
  • Snort++ Build 186 Available Now Snort Releases (Mar 02)
• Snorby-barnyard2 connection ARUN LAL (Feb 12)
• Compiling and Running Snort 2.9.8.0 on MAC OSX 10.11.3 (El Capitan) Madhu Rao (Feb 12)
  • Re: Compiling and Running Snort 2.9.8.0 on MAC OSX 10.11.3 (El Capitan) Joel Esler (jesler) (Feb 15)
    • Re: Compiling and Running Snort 2.9.8.0 on MAC OSX 10.11.3 (El Capitan) Bill Parker (Feb 15)
    • Re: Compiling and Running Snort 2.9.8.0 on MAC OSX 10.11.3 (El Capitan) Madhu Rao (Feb 15)
      • Re: Compiling and Running Snort 2.9.8.0 on MAC OSX 10.11.3 (El Capitan) Bill Parker (Feb 15)
      • Re: Compiling and Running Snort 2.9.8.0 on MAC OSX 10.11.3 (El Capitan) Madhu Rao (Feb 15)
• Snort Alert Mysql Query adonis okpidi (Feb 13)
  • Re: Snort Alert Mysql Query wkitty42 (Feb 13)
    • Re: Snort Alert Mysql Query adonis okpidi (Feb 14)
      • Re: Snort Alert Mysql Query Rob MacGregor (Feb 15)
      • Message not available
      • Re: Snort Alert Mysql Query Rob MacGregor (Feb 15)
      • Message not available
      • Re: Snort Alert Mysql Query Rob MacGregor (Feb 15)
  • <Possible follow-ups>
  • Snort Alert MySQL Query adonis okpidi (Mar 14)
    • Re: Snort Alert MySQL Query 강명훈 (Mar 15)
      • Re: Snort Alert MySQL Query adonis okpidi (Mar 15)
• Snort Subscriber Rules Update 2016-02-13 Research (Feb 13)
• segmentation fault in snort 3.0.0-a3 with hyperscan search engine Ramya Potluri (Feb 15)
  • Re: segmentation fault in snort 3.0.0-a3 with hyperscan search engine Russ (Feb 15)
    • Re: segmentation fault in snort 3.0.0-a3 with hyperscan search engine Russ (Feb 23)
• snorby problems ARUN LAL (Feb 15)
• email ARUN LAL (Feb 15)
• barnyard2 - snort database connection ARUN LAL (Feb 15)
• Unified2 filling up HDD Matthew White (Feb 15)
  • Re: Unified2 filling up HDD wkitty42 (Feb 15)
• using snort to track file movement? Jason Haar (Feb 15)
• Precomplies so_rules for debian 8 (snortrules-snapshot-2980.tar.gz) Balasubramaniam Natarajan (Feb 16)
  • Re: Precomplies so_rules for debian 8 (snortrules-snapshot-2980.tar.gz) wkitty42 (Feb 16)
    • Re: Precomplies so_rules for debian 8 (snortrules-snapshot-2980.tar.gz) Balasubramaniam Natarajan (Feb 18)
      • Re: Precomplies so_rules for debian 8 (snortrules-snapshot-2980.tar.gz) wkitty42 (Feb 18)
• 500 error ARUN LAL (Feb 16)
  • Re: 500 error wkitty42 (Feb 16)
• Snort Subscriber Rules Update 2016-02-16 Research (Feb 16)
• Mcafee IDS rule processing Adrian Good (Feb 16)
  • Re: Mcafee IDS rule processing Joel Esler (jesler) (Feb 16)
• Fwd: Snort Alerts in Unix Sockets Nauman Ahmad (Feb 16)
  • Fwd: Snort Alerts in Unix Sockets Nauman Ahmad (Feb 16)
    • Re: Fwd: Snort Alerts in Unix Sockets Ed Borgoyn (eborgoyn) (Feb 17)
• CVE-2015-7547 (GlibC bug) rules Dheeraj Gupta (Feb 17)
  • Re: CVE-2015-7547 (GlibC bug) rules Geoffrey Serrao (Feb 17)
  • Re: CVE-2015-7547 (GlibC bug) rules Lionel PRAT (Feb 19)
• snort + ossec ARUN LAL (Feb 17)
  • Re: snort + ossec lists (Feb 17)
• Re snort plus Ossetia Don M. (Feb 17)
• Issue / error with unified2 output when enabling appid_event_types Noah Dietrich (Feb 17)
• Error: /etc/snort/snort.conf(291) => invalid stream tcp policy option priyank shah (Feb 18)
  • Re: Error: /etc/snort/snort.conf(291) => invalid stream tcp policy option Al Lewis (allewi) (Feb 18)
    • Re: Error: /etc/snort/snort.conf(291) => invalid stream tcp policy option priyank shah (Feb 18)
      • Re: Error: /etc/snort/snort.conf(291) => invalid stream tcp policy option Joel Esler (jesler) (Feb 18)
  • Re: Error: /etc/snort/snort.conf(291) => invalid stream tcp policy option Vishnu Sriram (visriram) (Feb 18)
    • Re: Error: /etc/snort/snort.conf(291) => invalid stream tcp policy option priyank shah (Feb 18)
      • Re: Error: /etc/snort/snort.conf(291) => invalid stream tcp policy option priyank shah (Feb 22)
      • Re: Error: /etc/snort/snort.conf(291) => invalid stream tcp policy option Carter Waxman (cwaxman) (Feb 22)
• barnyard2 unable to start in centos6.7 ARUN LAL (Feb 18)
  • Re: barnyard2 unable to start in centos6.7 wkitty42 (Feb 18)
• Snort Subscriber Rules Update 2016-02-18 Research (Feb 18)
• Static linking for Dynamic Preprocessors jinho hwang (Feb 19)
• README.session file is absent? Husnu Demir (Feb 19)
  • Re: README.session file is absent? Ed Borgoyn (eborgoyn) (Feb 19)
    • Re: README.session file is absent? Joel Esler (jesler) (Feb 19)
• install directory for dynamicpreprocessor jinho hwang (Feb 19)
• Wordpress-attack ARUN LAL (Feb 20)
  • Re: Wordpress-attack Joel Esler (jesler) (Feb 22)
• sfPortscan - false positive Izik Birka (Feb 21)
  • <Possible follow-ups>
  • sfPortscan - false positive Izik Birka (Feb 21)
    • Re: sfPortscan - false positive Y M (Feb 21)
      • Re: sfPortscan - false positive Izik Birka (Feb 21)
      • Re: sfPortscan - false positive Y M (Feb 21)
      • Re: sfPortscan - false positive Izik Birka (Feb 21)
      • Re: sfPortscan - false positive Y M (Feb 21)
      • Re: sfPortscan - false positive Izik Birka (Feb 21)
      • Re: sfPortscan - false positive Y M (Feb 21)
      • Re: sfPortscan - false positive Izik Birka (Feb 21)
      • Re: sfPortscan - false positive Y M (Feb 21)
      • Re: sfPortscan - false positive Izik Birka (Feb 21)
      • Re: sfPortscan - false positive Y M (Feb 21)
      • Re: sfPortscan - false positive Izik Birka (Feb 22)
• Snort on Windows server 2008 R2 Jason Long (Feb 22)
  • Re: Snort on Windows server 2008 R2 Joel Esler (jesler) (Feb 22)
    • Re: Snort on Windows server 2008 R2 Jason Long (Feb 22)
      • Re: Snort on Windows server 2008 R2 wkitty42 (Feb 22)
      • Re: Snort on Windows server 2008 R2 Jason Long (Feb 22)
      • Re: Snort on Windows server 2008 R2 Jason Long (Feb 23)
• Is my "snort.conf" OK? Jason Long (Feb 22)
  • Re: Is my "snort.conf" OK? Joel Esler (jesler) (Feb 22)
    • Re: Is my "snort.conf" OK? Jason Long (Feb 22)
      • Re: Is my "snort.conf" OK? Jason Long (Feb 22)
      • Re: Is my "snort.conf" OK? Joel Esler (jesler) (Feb 22)
      • Re: Is my "snort.conf" OK? Jason Long (Feb 22)
• MY SNORT DETECT only one IP: 0.0.0.0:68 UDP. Saulo Fernandes (Feb 22)
  • Re: MY SNORT DETECT only one IP: 0.0.0.0:68 UDP. Y M (Feb 24)
• Re: MY SNORT DETECT only one IP: 0.0.0.0:68 UDP Carlos Rodriguez Hernandez (Feb 22)
• Snort.conf 2.9.8.0 setests setests (Feb 23)
• Snort Subscriber Rules Update 2016-02-23 Research (Feb 23)
• Snort/daq MPI Y M (Feb 23)
  • Re: Snort/daq MPI Y M (Feb 23)
    • Re: Snort/daq MPI Carter Waxman (cwaxman) (Feb 24)
      • Re: Snort/daq MPI Y M (Feb 24)
• ERROR: C:\snort\etc\snort.conf(246) Missing/incorrect dynamic engine lib specifier. Jason Long (Feb 24)
• Email alerts ARUN LAL (Feb 24)
  • Re: Email alerts lists (Feb 24)
    • Re: Email alerts Mikey van der Worp (Feb 24)
      • Re: Email alerts lists (Feb 24)
• community-rules file with appended data at the end. Lamont, Brian A. (Feb 24)
  • Re: community-rules file with appended data at the end. Joel Esler (jesler) (Feb 24)
  • Re: community-rules file with appended data at the end. wkitty42 (Feb 24)
    • Re: community-rules file with appended data at the end. Lamont, Brian A. (Feb 24)
• Rule wont disable Luke Ager (Feb 25)
  • Re: Rule wont disable Doug Burks (Feb 25)
• DAQ dump: load-mode passive on dummy interface vs read-file Mike Cox (Feb 25)
  • Re: DAQ dump: load-mode passive on dummy interface vs read-file Mike Cox (Feb 29)
  • <Possible follow-ups>
  • Re: DAQ dump: load-mode passive on dummy interface vs read-file abed mohammad kamaluddin (Feb 29)
    • Re: DAQ dump: load-mode passive on dummy interface vs read-file Mike Cox (Mar 01)
• IPID field filtering Mcintosh, Fraser (Feb 25)
  • Re: IPID field filtering Geoffrey Serrao (Feb 25)
• SFSnortPacket HTTP Inspect buffer Fakhri Zulkifli (Feb 25)
• Snort Subscriber Rules Update 2016-02-25 Research (Feb 25)
• Need Rules for blocking IP's ARUN LAL (Feb 26)
  • Re: Need Rules for blocking IP's Al Lewis (allewi) (Feb 26)
• Snort can't work on Windows server 2008 R2!!! Jason Long (Feb 26)
  • Re: Snort can't work on Windows server 2008 R2!!! Michael Steele (Feb 27)
    • Re: Snort can't work on Windows server 2008 R2!!! Jason Long (Feb 27)
      • Re: Snort can't work on Windows server 2008 R2!!! Michael Steele (Feb 27)
• config trbl test (Feb 27)
  • Re: config trbl Michael Steele (Feb 27)
• ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack ARUN LAL (Feb 29)
  • Re: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack wkitty42 (Feb 29)
• Snorby Timestamp ARUN LAL (Feb 29)
• Add additional private IP address blocks to Snort-2.9.8.0 Bill Parker (Feb 29)
• Preprocessor Question. David A. (Mar 01)
  • Re: Preprocessor Question. Al Lewis (allewi) (Mar 01)
    • Re: Preprocessor Question. David A. (Mar 01)
      • Re: Preprocessor Question. Al Lewis (allewi) (Mar 01)
      • Re: Preprocessor Question. David A. (Mar 01)
      • Re: Preprocessor Question. David A. (Mar 08)
• Snort Subscriber Rules Update 2016-03-01 Research (Mar 01)
• Snort Subscriber Rules Update 2016-03-03 Research (Mar 03)
  • <Possible follow-ups>
  • Snort Subscriber Rules Update 2016-03-03 Research (Mar 03)
• DNS Rules Luke Ager (Mar 04)
  • Re: DNS Rules Shirkdog (Mar 04)
    • Re: DNS Rules Luke Ager (Mar 04)
      • Re: DNS Rules Shirkdog (Mar 04)
• Clarification about Snort configuration files Y M (Mar 07)
  • Re: Clarification about Snort configuration files Joel Esler (jesler) (Mar 07)
• Mac Transmission BitTorrent ransomware John York (Mar 07)
  • Re: Mac Transmission BitTorrent ransomware Joel Esler (jesler) (Mar 07)
• FIX: snort-2.9.8.0 encode.c UDP_Encode has Coverity issue on line 992 Jeff Sass (Mar 07)
• Snort rules for CVE-2011-1255 commented out Julia Gustafsson (Mar 07)
  • Re: Snort rules for CVE-2011-1255 commented out Joel Esler (jesler) (Mar 07)
• Snort Blog: Snort 2.9.6.2 is EOL! Joel Esler (jesler) (Mar 08)
• Snort Subscriber Rules Update 2016-03-08 Research (Mar 08)
• Snort++ build 191 is now available on snort.org Snort Releases (Mar 08)
  • <Possible follow-ups>
  • Snort++ build 191 is now available on snort.org Snort Releases (Mar 08)
• Snort looking for invalid rules directory Ryan Bateman (Mar 09)
  • Re: Snort looking for invalid rules directory wkitty42 (Mar 13)
• NIDS + packet logging - only alert packets get logged Rich Lee (Mar 09)
  • Re: NIDS + packet logging - only alert packets get logged Al Lewis (allewi) (Mar 09)
  • Re: NIDS + packet logging - only alert packets get logged Al Lewis (allewi) (Mar 09)
    • Re: NIDS + packet logging - only alert packets get logged Rich Lee (Mar 09)
      • Re: NIDS + packet logging - only alert packets get logged Al Lewis (allewi) (Mar 09)
      • Re: NIDS + packet logging - only alert packets get logged Rich Lee (Mar 09)
      • Re: NIDS + packet logging - only alert packets get logged Carter Waxman (cwaxman) (Mar 09)
      • Re: NIDS + packet logging - only alert packets get logged Joel Esler (jesler) (Mar 09)
      • Re: NIDS + packet logging - only alert packets get logged Rich Lee (Mar 10)
      • Re: NIDS + packet logging - only alert packets get logged Joel Esler (jesler) (Mar 10)
      • Re: NIDS + packet logging - only alert packets getlogged Rich Lee (Mar 10)
      • Re: NIDS + packet logging - only alert packets get logged Rodgers, Anthony (DTMB) (Mar 09)
      • Re: NIDS + packet logging - only alert packets get logged Rich Lee (Mar 09)
      • Re: NIDS + packet logging - only alert packets get logged James Lay (Mar 09)
• Snort Blog: Community Snort Rule Monthly Detection Contest! Joel Esler (jesler) (Mar 09)
  • Re: Snort Blog: Community Snort Rule Monthly Detection Contest! Joel Esler (jesler) (Mar 09)
• Snort Subscriber Rules Update 2016-03-09 Research (Mar 09)
• RuleHound - Snort Rule Evaluation Tool Tyler Smith (Mar 09)
  • Re: RuleHound - Snort Rule Evaluation Tool Rich Lee (Mar 10)
• pulledpork rules update error 422 Mathias Conde (Mar 09)
  • Re: pulledpork rules update error 422 Shirkdog (Mar 09)
    • Re: pulledpork rules update error 422 Mathias Conde (Mar 09)
      • Re: pulledpork rules update error 422 Joel Esler (jesler) (Mar 09)
• Snort Subscriber Rules Update 2016-03-10 Research (Mar 10)
• [PATCH] Potential NULL pointer dereference (CWE-476) in Snort-3.0.0-a4 (Build 191) Bill Parker (Mar 10)
  • Re: [PATCH] Potential NULL pointer dereference (CWE-476) in Snort-3.0.0-a4 (Build 191) Russ (Mar 10)
• passive mode ARUN LAL (Mar 11)
  • Re: passive mode Al Lewis (allewi) (Mar 11)
• Snort SID Help 1:28039:5 Matt Brichetto (Mar 11)
  • Re: Snort SID Help 1:28039:5 Joel Esler (jesler) (Mar 11)
    • Re: Snort SID Help 1:28039:5 Vincent Zhen (Mar 11)
      • Re: Snort SID Help 1:28039:5 Vincent Zhen (Mar 11)
  • Re: Snort SID Help 1:28039:5 Vincent Zhen (Mar 11)
• Snort Subscriber Rules Update 2016-03-11 Research (Mar 11)
• Need rules ARUN LAL (Mar 12)
• log files empty Mark Cole (Mar 13)
  • Re: log files empty wkitty42 (Mar 13)
    • Re: log files empty Rodgers, Anthony (DTMB) (Mar 14)
• DROWN Rule Scott Ellis (Mar 14)
  • Re: DROWN Rule Joel Esler (jesler) (Mar 14)
• Snort Subscriber Rules Update 2016-03-15 Research (Mar 15)
• RELRO security in Snort-2.9.x Bill Parker (Mar 15)
  • Re: RELRO security in Snort-2.9.x Victor Roemer (Mar 15)
• Unified2 file problem in Windows server 2012 Asad, Hafiz ul (Mar 16)
• Snort Subscriber Rules Update 2016-03-17 Research (Mar 17)
• Snort rules ARUN LAL (Mar 18)
  • Re: Snort rules Elliot Anderson (Mar 18)
• missing alerts: Snort does not inspect payload from the machine it's running on? Claus Regelmann (Mar 18)
• [HITB-Announce] HITBGSEC 2016 CFP Hafez Kamal (Mar 21)
• Setting up a rule for a repeating pattern Gurgen Hakobyan (Mar 21)
  • Re: Setting up a rule for a repeating pattern Geoffrey Serrao (Mar 21)
• Snort Subscriber Rules Update 2016-03-22 Research (Mar 22)
• Query on Snort and kill -usr1 Balasubramaniam Natarajan (Mar 22)
• Integration of Snort with the ODL controller priyankshah902002 (Mar 22)
• Re: [Emerging-Sigs] Offer a new sig for detecting possible last PCRE overflow Will Metcalf (Mar 23)
• Snort Subscriber Rules Update 2016-03-23 Research (Mar 23)
• Counting packets - Flow Gurgen Hakobyan (Mar 23)
• [HITB-Announce] HITB2016AMS CommSec Call for Papers Hafez Kamal (Mar 24)
• Snort Subscriber Rules Update 2016-03-24 Research (Mar 24)
• help - React keyword use to display message on web browser Amul Patel (Mar 25)
  • Re: help - React keyword use to display message on web browser Al Lewis (allewi) (Mar 25)
    • Re: help - React keyword use to display message on web browser Amul Patel (Mar 28)
      • Re: help - React keyword use to display message on web browser Al Lewis (allewi) (Mar 28)
      • Re: help - React keyword use to display message on web browser Amul Patel (Mar 28)
      • Re: help - React keyword use to display message on web browser Amul Patel (Mar 28)
      • Re: help - React keyword use to display message on web browser Al Lewis (allewi) (Mar 29)
      • Re: help - React keyword use to display message on web browser Amul Patel (Mar 30)
      • Re: help - React keyword use to display message on web browser Amul Patel (Mar 29)
      • Re: help - React keyword use to display message on web browser Amul Patel (Mar 31)
      • Re: help - React keyword use to display message on web browser Amul Patel (Mar 31)
      • Re: help - React keyword use to display message on web browser wkitty42 (Mar 31)
      • Re: help - React keyword use to display message on web browser Al Lewis (allewi) (Mar 28)
• Infosec Institute Snort Rules Workshop James Lay (Mar 25)
• Snort Subscriber Rules Update 2016-03-29 Research (Mar 29)
• Max. allowed bytes to extract Y M (Mar 29)
  • Re: Max. allowed bytes to extract Alex McDonnell (Mar 29)
    • Re: Max. allowed bytes to extract Y M (Mar 29)
• Config Trouble valentin . giraud (Mar 30)
  • Re: Config Trouble Gaurav Nagare (gnagare) (Mar 31)
• Snort 2.9.8.2 Now Available Snort Releases (Mar 30)
  • Fwd: [Snort-devel] Snort 2.9.8.2 Now Available Balasubramaniam Natarajan (Mar 31)
  • <Possible follow-ups>
  • Snort 2.9.8.2 Now Available Snort Releases (Mar 30)
• MALWARE-CNC TRUFFLEHUNTER SFVRT-1020 attack attempt" rule being fired Daniel (Mar 30)
  • Re: MALWARE-CNC TRUFFLEHUNTER SFVRT-1020 attack attempt" rule being fired Joel Esler (jesler) (Mar 31)
• Email alert ARUN LAL (Mar 31)
• Barnyard 2 latest not reading snort logs Michael Steele (Mar 31)
• Snort Subscriber Rules Update 2016-03-31 Research (Mar 31)
• Re: help - React keyword use to display message on web browser Amul Patel (Mar 31)
  • Re: help - React keyword use to display message on web browser Al Lewis (allewi) (Mar 31)
    • Re: help - React keyword use to display message on web browser Amul Patel (Mar 31)

Previous period

Next period