Snort: by author

Previous period
Next period

1488 messages starting Apr 29 01 and ending Jun 06 01
Date index | Thread index | Author index

./

Re: snort behind firewall ?? ./ (Apr 29)
Re: snort behind firewall ?? ./ (Apr 29)

정윤정

(no subject) 정윤정 (Jun 09)

Aaron

Re: syn/fin and src port Aaron (Jun 06)

Aaron McKinnon

snortsnarf Aaron McKinnon (May 09)
RE: snort + aris Aaron McKinnon (May 11)
RE: Error: unable to open local.rules Aaron McKinnon (Jun 08)
simple pass rules Aaron McKinnon (May 07)
RE: Whad'ya do? Aaron McKinnon (May 08)
conf/rules problems Aaron McKinnon (May 23)
RE: simple pass rules Aaron McKinnon (May 07)

agetchel

RE: Snort hardware issues agetchel (Jun 13)

akshaye kalkura

reg snort akshaye kalkura (Jun 25)

Alain Tésio

A script to store ips and hostnames in the event table Alain Tésio (Jun 25)
Re: Snort Problem Alain Tésio (Jun 14)

Alain Tésio

Re: RE: Snort Install Doc Alain Tésio (Jun 27)
Empty alert file, but big snort log and event database Alain Tésio (Jun 13)

Alejandro Nunez Sandoval

Re: Problem using snort Alejandro Nunez Sandoval (May 20)

Alexandre Dulaunoy

Re: Snort and Ethereal Alexandre Dulaunoy (May 05)
snort pgsql keepalive Alexandre Dulaunoy (May 10)
Acid : OUTER JOINRe: CVS changes in ACID Alexandre Dulaunoy (May 05)
Re: Acid : OUTER JOINRe: CVS changes in ACID Alexandre Dulaunoy (May 05)
acid/snort 1.8beta Re: Acid : OUTER JOINRe: CVS changes in ACID Alexandre Dulaunoy (May 05)
Re: Rule Managment Tool Alexandre Dulaunoy (May 10)

Alex Stephens

libpcap vs. ethernet drivers Alex Stephens (Apr 29)

alexus

Re: Snort + Acid w/ MySQL question(s) alexus (May 11)
Snort + Acid w/ MySQL question(s) alexus (May 10)
Re: Snort won't run alexus (May 10)
snort detects portscan? alexus (Jun 19)
Re: Snort + Acid w/ MySQL question(s) alexus (May 11)
snort+mysql permition alexus (Jun 12)
php --with-gd won't compile alexus (May 15)
Re: Snort + Acid w/ MySQL question(s) alexus (May 11)
Re: Snort + Acid w/ MySQL question(s) alexus (May 11)
snort+acid (graphic alert data) alexus (May 23)
Re: Snort + Acid w/ MySQL question(s) alexus (May 10)
Re: Snort + Acid w/ MySQL question(s) alexus (May 13)
Re: Snort + Acid w/ MySQL question(s) alexus (May 11)
Snort won't run alexus (May 10)
Re: Snort + Acid w/ MySQL question(s) alexus (May 11)
wont create any graphics in Graph Alert data alexus (May 17)
(no subject) alexus (May 01)
snort + acid w/ graphic alert area alexus (May 23)
acid + graphic alert area alexus (May 21)
Re: php --with-gd alexus (May 15)
Re: Snort + Acid w/ MySQL question(s) alexus (May 11)
Re: Snort won't run alexus (May 11)
Re: Snort won't run alexus (May 10)
Re: acid + graphic alert area alexus (May 21)
Re: snort detects portscan? alexus (Jun 19)
php --with-gd alexus (May 15)
Re: snort detects portscan? alexus (Jun 20)
Re: Snort + Acid w/ MySQL question(s) alexus (May 11)

Al Huger - Mail Account

ARIS extractor 1.01 Beta 2 has just been released. Al Huger - Mail Account (May 02)

alim

rule problem alim (Jun 08)
packetgetstats error alim (Jun 08)

A.L.Lambert

Re: [Fwd: Limits to what ACID can handle?] A.L.Lambert (Jun 11)
FYI - Avoiding bullet->foot w/ Syslog (was Content "c:") A.L.Lambert (Jun 20)

Anderson, Bill

What does lightweight mean? Anderson, Bill (May 30)

Andrea Barisani

Sound Alerting Preprocessor Andrea Barisani (May 02)

Andreas Hasenack

inconsistency in acid-0.9.6b10? Andreas Hasenack (May 20)
alert message containing info from the packet? Andreas Hasenack (May 10)
Re: acid + graphic alert area Andreas Hasenack (May 21)
Re: CVS or 1.7? Andreas Hasenack (Jun 11)
Error in acid-0.9.6b9 Andreas Hasenack (May 13)
Re: Rule Managment Tool Andreas Hasenack (May 10)
Re: Snort reporting and alerting Andreas Hasenack (May 29)
ACID: whois (ip-cache?) support and DB permissions Andreas Hasenack (Jun 06)
Re: ACID: more alerts than I asked for in acid_stat_uaddr... :) Andreas Hasenack (Jun 25)
Re: inconsistency in acid-0.9.6b10? Andreas Hasenack (May 24)
Re: ACID and snort 1.8? Andreas Hasenack (Jun 14)
Re: enter/exit promisc mode occasionally? Andreas Hasenack (Jun 14)
ACID: more alerts than I asked for in acid_stat_uaddr... :) Andreas Hasenack (Jun 19)
Re: snort + aris Andreas Hasenack (May 15)
Re: ACID: more alerts than I asked for in acid_stat_uaddr... :) Andreas Hasenack (Jun 25)
Re: FW: [ACID Newcomer] snort.signature table not avail able error Andreas Hasenack (May 24)
Re: ACID and snort 1.8? Andreas Hasenack (Jun 13)
Re: ACID: more alerts than I asked for in acid_stat_uaddr... :) Andreas Hasenack (Jun 24)
Re: inconsistency in acid-0.9.6b10? Andreas Hasenack (May 23)
CVS changes in ACID Andreas Hasenack (May 04)
Re: alert message containing info from the packet? Andreas Hasenack (May 10)
Re: TCP Reset Andreas Hasenack (May 20)
Snort database schema depends on snort's version? Andreas Hasenack (Jun 10)

Andreas Lindenblatt

Re: Centralized DB Server?? Andreas Lindenblatt (Jun 12)

Andreas Östling

Re: sadmind rule Andreas Östling (May 09)
arachnids_upd v0.3 Andreas Östling (May 08)
Re: How do you know... Andreas Östling (Jun 09)
Re: sadmind rule Andreas Östling (May 09)

Andre Goeree

[ACID] error in create_acid_tbls_pgsql.sql Andre Goeree (Jun 15)
Re: snort behind firewall ?? Andre Goeree (May 01)
stream3_leak_finder.log Andre Goeree (May 13)
[ACID] Call to undefined function: acidlong2ip() Andre Goeree (May 17)

andres

Comunidad en Español andres (Jun 22)

Andrew Daviel

re. scan reporter script Andrew Daviel (May 07)
Re: sadmind rule Andrew Daviel (May 09)
portscan false alerts on NFS & ftp Andrew Daviel (Jun 02)
Re: getcontact utility Andrew Daviel (Jun 19)
sadmind rule Andrew Daviel (May 09)
DNS, portscan, & laptops Andrew Daviel (Jun 18)
Portscan log parser/reporter Andrew Daviel (May 02)
Re: DNS, portscan, & laptops Andrew Daviel (Jun 18)
Portscan log parser/reporter - update Andrew Daviel (Jun 04)
Re: DNS, portscan, & laptops Andrew Daviel (Jun 18)

Andrew J. Bostaph

Problem with resp Andrew J. Bostaph (May 18)
Portscan preprocessor tweaking Andrew J. Bostaph (May 15)

Andy Bach

Vision rules EXTERNAL/EXTERNAL_NET Andy Bach (May 16)

Andy Dougherty

RE: Can I stop these port 53 detects? Andy Dougherty (Jun 27)

Andy Duncan

RE: Win98 Internet Connection Sharing Andy Duncan (Jun 05)
Win98 Internet Connection Sharing Andy Duncan (Jun 05)

Andy Lowton

Re: unsubscribe Andy Lowton (May 11)

Angelos Karageorgiou

new tools for 3D plotting Angelos Karageorgiou (May 29)

Anthony Buser

RE: Strange ping activity Anthony Buser (May 22)
RE: binary log? Anthony Buser (May 25)
RE: xml plugging docs Anthony Buser (May 25)
RE: logging question Anthony Buser (May 25)
RE: logging question Anthony Buser (May 25)
RE: logging question Anthony Buser (May 25)

Austad, Jay

RE: Can snort co-exist on same system along with NTOP? Austad, Jay (Jun 19)

Avleen Vig

[OT]? Security work Avleen Vig (Jun 19)
AOL Mail relay scanning rule Avleen Vig (May 03)
Slightly OT - Re: My apologies Avleen Vig (May 11)
Re: {off-topic} Who goes 2 Defcon9 Avleen Vig (Jun 04)

ayse

Newbie questions: logs ayse (Jun 11)
Newbie questions: logs ayse (Jun 09)

Bamm Visscher

Re: Problem with resp Bamm Visscher (May 24)
Re: ACID Bamm Visscher (May 04)

barre

catch all rule barre (Jun 18)

Barry Treahy, Jr.

Intro to Snort Barry Treahy, Jr. (Apr 30)

Benjamin Krueger

Re: GRC.com attack and TCP stacks Benjamin Krueger (Jun 23)

Benjamin Morin

Snort rules parser Benjamin Morin (Jun 12)

Ben Johansen

1.8? Ben Johansen (Jun 04)
is there anyway of stoping this? Ben Johansen (May 31)
resp? Ben Johansen (May 15)
Smurf Amplification Attack Ben Johansen (May 29)
resp 2? Ben Johansen (May 15)
NETBIOS NT NULL session? Ben Johansen (May 16)
Test Send Ben Johansen (May 14)

Ben Lovett

Bad Priority setting "info-attempt" Ben Lovett (Jun 29)

Bennett Samowich

Stopping particular rules Bennett Samowich (Jun 25)

Ben Paul Wise

Re: DoD plugin Ben Paul Wise (May 01)

Bill Gercken

RE: Snort 1.8 Beta5 Build 24 - Leak Bill Gercken (May 15)
RE: 1.8? Bill Gercken (Jun 04)

Bill Marquette

Re: Article in June SysAdmin Bill Marquette (May 22)
Re: eri* on Netra's Bill Marquette (May 04)
Re: Starting snort against multiple interfaces? Bill Marquette (Jun 19)
Re: Starting snort against multiple interfaces? Bill Marquette (Jun 19)
Article in June SysAdmin Bill Marquette (May 22)

Blake Frantz

Re: snort trips.. Blake Frantz (Jun 18)
RE: AOL Instant Messenger signature? Blake Frantz (May 01)
Re: acid 0.9.6b9 Blake Frantz (Jun 22)
acid v0.9.5 addon. Blake Frantz (Jun 28)
loggin to mySQL Blake Frantz (Jun 17)
Re: UPDATE:: Compilation errors with mySQL Blake Frantz (Jun 14)
Re: AOL Instant Messenger signature? Blake Frantz (May 01)
Compilation errors with mySQL Blake Frantz (Jun 14)
Re: Snorts competition falling like flies Blake Frantz (May 20)
UPDATE:: Compilation errors with mySQL Blake Frantz (Jun 14)

Bob

Strange ping activity Bob (May 22)

Bob Bernstein

IDS254 False positive? Bob Bernstein (May 22)
Re: IDS254 False positive? Bob Bernstein (May 22)

Bob Staaf

Re: I'm being attacked, now what? Bob Staaf (Jun 15)
Re: I'm being attacked, now what? Bob Staaf (Jun 15)

Bob Van Cleef

Is this a realy a bogus portscan report? Bob Van Cleef (May 07)

Borja Marcos

Re: Bug with timestamp. Snort 1.8 and FreeBSD and ACID Borja Marcos (Jun 19)
Bug with timestamp. Snort 1.8 and FreeBSD and ACID Borja Marcos (Jun 19)
Problem with Acid 0.9.6b11 (from CVS): criteria propagation Borja Marcos (Jun 26)

Brent Kearney

Re: Libnet & 'resp' Brent Kearney (Jun 20)
Re: Libnet & 'resp' Brent Kearney (Jun 20)
Libnet & 'resp' Brent Kearney (Jun 20)
Re: Libnet & 'resp' Brent Kearney (Jun 21)

bretwatson

(no subject) bretwatson (May 16)

Brian Carpio

Re: Snort Rules Brian Carpio (Jun 08)
Compiling Snort Under Solaris 8 Brian Carpio (Jun 05)
Snort Rules Brian Carpio (Jun 07)

Brian Caswell

Re: Arghh...how do I stop it doing this!! Brian Caswell (May 03)
Re: Query about description of SSL option in configure Brian Caswell (May 02)
Re: Starting snort against multiple interfaces? Brian Caswell (Jun 19)
Re: DNS, portscan, & laptops Brian Caswell (Jun 18)
Re: FW: snort & logging Brian Caswell (Jun 13)
IIS 5.0 printer exploit signature Brian Caswell (May 02)
Re: Trouble with home-made rule Brian Caswell (Jun 17)
Re: alarm levels assigned to Snort rules Brian Caswell (Jun 26)
Re: chameleon overflow Brian Caswell (Jun 08)
Re: [Snort-devel] classification changes Brian Caswell (May 23)
Re: How do you know... Brian Caswell (Jun 08)
Re: ignore host for just a couple of rules, not all Brian Caswell (Jun 15)
Re: Garbled classification Brian Caswell (Jun 05)
Re: IP needed Brian Caswell (May 16)
Re: Ramen worm and Snort log entry Brian Caswell (Jun 17)
classification changes Brian Caswell (May 22)
Re: Newbie: Bot Detection Rule Brian Caswell (Jun 21)

Bruce Platt

RE: FW: [ACID Newcomer] snort.signature table not a vail Bruce Platt (May 24)
RE: FW: [ACID Newcomer] snort.signature table not a vail Bruce Platt (May 25)
RE: FW: [ACID Newcomer] snort.signature table not a Bruce Platt (May 25)
FW: [ACID Newcomer] snort.signature table not avail able error Bruce Platt (May 24)

Bui, Khiem Q

hi and low source port in SNORT parser Bui, Khiem Q (Jun 11)

Bulent yildiz

Need Help Bulent yildiz (Apr 30)

Bunter, Matthew

RE: snort.conf and rules Bunter, Matthew (May 15)
RE: Port 10008/tcp ? Bunter, Matthew (May 22)
Snort newbie Bunter, Matthew (May 10)
RE: Port 10008/tcp ? Bunter, Matthew (May 15)
snort.conf and rules Bunter, Matthew (May 15)

Burleson, Lee (IA)

RE: Win98 Internet Connection Sharing Burleson, Lee (IA) (Jun 06)
RE: Win98 Internet Connection Sharing Burleson, Lee (IA) (Jun 05)

Cameron Just

Rule IP addr (!192.168.1.1) didn't x-late, WTF? Cameron Just (Jun 26)
RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Cameron Just (Jun 27)
RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Cameron Just (Jun 27)
RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Cameron Just (Jun 27)

Caruso, Ken

RE: Whitehats rules don't work Caruso, Ken (Jun 04)
RE: {off-topic} Who goes 2 Defcon9 Caruso, Ken (Jun 04)

cds

Re: Snort-users digest, Vol 1 #260 - 4 msgs cds (Jun 01)

Cedric

{off-topic} Who goes 2 Defcon9 Cedric (Jun 02)
Re: Smurf Amplification Attack Cedric (May 29)

Cedric Guillotin

Re: RE:Acid Cedric Guillotin (May 07)
Re: Rule Managment Tool Cedric Guillotin (May 10)
Snort solaris perfs Cedric Guillotin (Jun 28)
Rule Managment Tool Cedric Guillotin (May 10)
Re: snort with mysql Cedric Guillotin (May 02)
Snort perf Cedric Guillotin (Apr 30)
Re: Rule Managment Tool Cedric Guillotin (May 10)

centipede

Re: Show alerts on console? centipede (May 02)

Chapman, Justin T

RE: Centralized DB Server?? Chapman, Justin T (Jun 14)
RE: Centralized DB Server?? Chapman, Justin T (Jun 19)

chlang

ruletype doesn't work at all ?! chlang (May 18)
Re: ruletype doesn't work at all ?! chlang (May 22)

Chris

the 1.7 ruleset files dont work Chris (May 05)
error with rulesets Chris (May 05)

Chris Eidem

Bogus savefile header Chris Eidem (Jun 07)

Chris Green

Re: Whitehats rules don't work Chris Green (Jun 04)
Re: [Snort-devel] classification changes Chris Green (May 23)
Re: [OT]? Security work Chris Green (Jun 19)
Re: deleting old entries in mysql Chris Green (Jun 01)
Re: Re:A new type of ICMP packet Chris Green (May 29)
Re: Newbie: Bot Detection Rule Chris Green (Jun 21)
Re: Help with Adapter Chris Green (May 18)
Re: Boneheaded CVS update question Chris Green (May 15)
Re: When is a hub not a hub? (AuthReply) Chris Green (Jun 07)
Re: alarm levels assigned to Snort rules Chris Green (Jun 26)
Re: >2Gb capture files Chris Green (Jun 25)
Re: What does lightweight mean? Chris Green (May 30)
Re: Meaning of exploit logs Chris Green (Jun 12)
Re: sadmind rule Chris Green (May 09)
Re: {off-topic} Who goes 2 Defcon9 Chris Green (Jun 04)
Re: Snort XML Output Chris Green (Jun 05)
Re: Alert messages and rule identification Chris Green (May 17)
Re: [Snort-devel] classification changes Chris Green (May 23)
Re: How to review actual packets? Chris Green (Jun 11)

Chris Ling

Logging to /var/log/snort/alert AND mysql? Chris Ling (May 09)

Chris Mason

need some advice on redhat webserver use Chris Mason (Jun 30)
Redhat webserver setup Chris Mason (Jun 11)

Chris Owen

Mysql table creation Chris Owen (Jun 13)
RE: Mysql table creation Chris Owen (Jun 13)

Chris Schuler

Snort 1.7 and Acid 0.9.6b9 and MySQL 3.23.32 Chris Schuler (May 16)

Claude Bailey

Intrusion Detection Event Claude Bailey (May 09)
Generating email alerts of overactive source IPs Claude Bailey (May 08)

Clifford, Shawn A

DoD plugin? Clifford, Shawn A (Apr 30)

Colin Wu

Error: unable to open local.rules Colin Wu (Jun 08)
Re: Snort Rules Colin Wu (Jun 07)
Re: Logging packet contents in alerts. Colin Wu (Jun 06)
[Fwd: Error: unable to open local.rules] Colin Wu (Jun 08)
Re: rpc.statd Colin Wu (Jun 06)
Re: commenting out rules? Colin Wu (Jun 18)
How do you know... Colin Wu (Jun 08)
False Positives Colin Wu (Jun 13)

Craig Woods

Re: Possible DOS Attack?? Craig Woods (Jun 18)
Snort detecting attacks... Craig Woods (May 20)
Re: Newbie: Bot Detection Rule Craig Woods (Jun 21)

Dan Cuthbert

Re: Name resolution Dan Cuthbert (May 18)

Dan Fiorito

RE: snort + mysql + acid + adodb Dan Fiorito (Jun 13)
acid 0.9.6b9 Dan Fiorito (Jun 22)
RE: Newbie Question... Please forgive...... Dan Fiorito (Jun 06)
RE: AOL Instant Messenger signature? Dan Fiorito (May 01)
Remote location Dan Fiorito (May 15)
RE: spp_http_decode: CGI Null Byte attack detected Dan Fiorito (May 29)

Dan Hollis

Re: When is a hub not a hub? (AuthReply) Dan Hollis (Jun 05)
Re: When is a hub not a hub? (AuthReply) Dan Hollis (Jun 06)
Re: When is a hub not a hub? (AuthReply) Dan Hollis (Jun 06)
Re: snort behind firewall ?? Dan Hollis (Apr 29)

Darian Jenik

Acid and Links to the Whitehats (etc) Alert Info. Darian Jenik (Jun 24)

Darrin Powell

Bad port number error?? Darrin Powell (Jun 14)
Snort Newbie Darrin Powell (Jun 14)

Dave Fitches

Arghh...how do I stop it doing this!! Dave Fitches (May 03)
RE: Snort and IPTables? Dave Fitches (Jun 12)
RE: Arghh...how do I stop it doing this!! Dave Fitches (May 03)

Dave . Hampel

Whad'ya do? Dave . Hampel (May 08)

Davis, Scott

RE: Checkpoint FW-1 Davis, Scott (Jun 20)

Davitt J. Potter

RE: the 1.7 ruleset files dont work Davitt J. Potter (May 05)
Re: IDScenter - windows GUI front end for Windows Snort Davitt J. Potter (May 03)

Dell, Jeffrey

applying command line in snort.conf Dell, Jeffrey (May 30)
RE: rule problem Dell, Jeffrey (Jun 08)
RE: rule problem Dell, Jeffrey (Jun 08)

Denis Augusto A. de Souza

Error in snort start (Duplicate processor keyword) e-mail number 2 Denis Augusto A. de Souza (May 18)
Error in snort start (Duplicate processor keyword) Denis Augusto A. de Souza (May 17)

Denis Ducamp

[Denis.Ducamp () hsc fr: [Snort-devel] french translations / traductions francaises] Denis Ducamp (May 03)
Re: Snort vs TCPdump Denis Ducamp (May 30)
Re: snort on stealth mode Denis Ducamp (May 31)

Dennis Cooper

Check out how Microsoft hacks... :) Dennis Cooper (May 01)

Devdas Bhagat

CVs is 1.7 or 1.8 Devdas Bhagat (Jun 20)

Didier CONTIS

Question about Incomplete Packet Fragments Discarded Didier CONTIS (May 20)

Dima Pankin

traffic counter Dima Pankin (May 03)

dmuz

Re: Testing Snort dmuz (May 31)
ACID: Cannot send session cache limiter dmuz (May 23)
Re: ACID + spp_portscan dmuz (May 24)

Dominick, David

Training info? Dominick, David (May 02)

Don Bailey

Snortbot v 0.1 now available -- Half-Life fans test it out, please. Thanks. Don Bailey (Jun 10)

Dragos Ruiu

Re: Trouble with home-made rule Dragos Ruiu (Jun 17)
Re: Merging new rules Dragos Ruiu (Jun 18)
Fwd: Re: Cisco HTTP Admin IOS attack signature Dragos Ruiu (Jun 29)
Re: Trouble with home-made rule Dragos Ruiu (Jun 17)
Re: Some assistance with Snort? Dragos Ruiu (May 28)
Re: Problem with resp Dragos Ruiu (May 22)
Cisco HTTP Admin IOS attack signature Dragos Ruiu (Jun 29)
Re: Cisco HTTP Admin IOS attack signature Dragos Ruiu (Jun 29)
Re: Trouble with home-made rule Dragos Ruiu (Jun 17)
Re: Cisco HTTP Admin IOS attack signature Dragos Ruiu (Jun 29)
Re: Logging UNICOIDE Dragos Ruiu (May 22)
Re: Snort. Dragos Ruiu (Jun 13)
Re: Does ICMP detection work or what? Dragos Ruiu (Jun 29)
Re: Snort reporting and alerting Dragos Ruiu (May 28)

Dr SuSE

RE: AOL Instant Messenger signature? Dr SuSE (May 01)
Re: {off-topic} Who goes 2 Defcon9 Dr SuSE (Jun 02)
Re: snort attacks Dr SuSE (May 29)
UDP is all I see.. Dr SuSE (May 16)
Re: UDP is all I see.. Dr SuSE (May 16)

ec4rock

Help ec4rock (May 23)

Ed Greshko

Where to configure/change rules for this one? Ed Greshko (May 03)
RE: Arghh...how do I stop it doing this!! Ed Greshko (May 03)
RE: What am I missing? Ed Greshko (May 05)
What am I missing? Ed Greshko (May 05)
RE: Snort RPM and Red Hat 7.1 Ed Greshko (May 04)
Snort RPM and Red Hat 7.1 Ed Greshko (May 04)
Missed Alerts Ed Greshko (May 07)
RE: Where to configure/change rules for this one? Ed Greshko (May 03)

Ed Padin

Is whitehats.com/arachnids gone? Ed Padin (Jun 12)
Problem Getting SnortSnarf to add links to log files in html output Ed Padin (Jun 22)

Edwin Chiu

Re: GRC.com attack and TCP stacks Edwin Chiu (Jun 22)
Snorth 1.8 to incl. AC-BM Algorithm? Edwin Chiu (May 09)
Snort 1.7 problem with -i any Edwin Chiu (Jun 04)
Re: Snorth 1.8 to incl. AC-BM Algorithm? Edwin Chiu (May 10)
Snort 1.7 problem with -i any Edwin Chiu (Jun 04)
Re: Snort 1.7 problem with -i any Edwin Chiu (Jun 05)
[Fwd: Several Misbehaviors with the ICMP implementation (and the 'ping'utility) with MS based operating systems] Edwin Chiu (May 06)
Re: Port 10008/tcp ? Edwin Chiu (May 15)

Edwin Covert

Rule Question Edwin Covert (May 11)

Effi Baruch

Snort basic questions Effi Baruch (Jun 10)

Erek Adams

Re: Can snort co-exist on same system along with NTOP? Erek Adams (Jun 19)
Re: Getting One instance of snort to sniff 2 interfaces Erek Adams (Apr 30)
Re: odd output plugin behavior? Erek Adams (Jun 19)
Re: Memory leak Erek Adams (May 03)
Re: Memory leak Erek Adams (May 03)
Re: DB configuration Erek Adams (May 07)
Unix Review writeup on Snort Erek Adams (Jun 25)
Re: Snort hardware issues Erek Adams (Jun 13)
Re: Starting snort against multiple interfaces? Erek Adams (Jun 19)
OT: "Pretty Packet Printer" Erek Adams (May 07)
Snort_Stat.pl and Full Alerts Erek Adams (Jun 05)
Re: snort + daemontools + chroot + remote mysql Erek Adams (Jun 27)
Re: simple pass rules Erek Adams (May 07)
Re: Content "c:" Erek Adams (Jun 19)

Eric Budke

Hub not a hub Eric Budke (Jun 05)

Erickson Brent W KPWA

BPF for ECN Bits Erickson Brent W KPWA (May 24)

Eric Van den Bossche

Compile under Linux kernel 2.4.3 Eric Van den Bossche (Jun 15)
RE: Compile under Linux kernel 2.4.3 Eric Van den Bossche (Jun 18)

Erik Engberg

RE: TCP Reset Erik Engberg (May 22)

Erik Fichtner

Re: Tcpdump, alerts and portscans Erik Fichtner (Jun 25)
Re: BPF for ECN Bits Erik Fichtner (May 24)
Re: Tcpdump, alerts and portscans Erik Fichtner (Jun 25)

Erik Norman

RE: Can I stop these port 53 detects? Erik Norman (Jun 27)
snort trips.. Erik Norman (Jun 18)

Esben Haabendal Soerensen

Re: Re[2]: performance snort question Esben Haabendal Soerensen (Jun 19)
Re: performance snort question Esben Haabendal Soerensen (Jun 19)
Re: performance snort question Esben Haabendal Soerensen (Jun 19)

Evan Himmel

Snort Problem Evan Himmel (Jun 14)

Fabio Bastiglia Oliva

Multiple Interfaces... Fabio Bastiglia Oliva (May 17)
Re[2]: Multiple Interfaces... Fabio Bastiglia Oliva (May 17)

Fernando Cardoso

RE: Portscan from own interface Fernando Cardoso (May 10)
RE: IDS254 False positive? Fernando Cardoso (May 22)
RE: Patch for stick Fernando Cardoso (May 08)

fm

Guardian ENHANCED fm (May 17)
Guardian-1.2.0 fm (May 25)

Francisco Jesus Monserrat Coll

using snort with atm ? Francisco Jesus Monserrat Coll (May 31)

Francisco Jose Gomez

cheese Worm Francisco Jose Gomez (May 17)

Frank Knobbe

RE: Read-Only Ethernet cable Frank Knobbe (Jun 19)
RE: RE: Read-Only Ethernet cable Frank Knobbe (Jun 21)
RE: 3rd Party Snort Stuff Frank Knobbe (May 02)
RE: TCP Reset Frank Knobbe (May 19)
New WinPCap driver Frank Knobbe (May 07)
RE: Checkpoint FW-1 Frank Knobbe (Jun 20)
RE: catch all rule Frank Knobbe (Jun 18)

François Désarménien

Re: Snort. François Désarménien (Jun 13)
Re: Does ICMP detection work or what? François Désarménien (Jun 29)
Re: Whitehats rules don't work François Désarménien (Jun 05)
Re: Can I stop these port 53 detects? François Désarménien (Jun 27)
Proprocessors alerts priority setting: how François Désarménien (May 28)
1.8beta4 and "Classification" garbage François Désarménien (May 02)
Re: rules error François Désarménien (Jun 13)

Fred Edwards

Re: How can I filter... Fred Edwards (Jun 22)
logging question Fred Edwards (May 25)
Re: logging question Fred Edwards (May 25)
How can I filter... Fred Edwards (Jun 22)

Fred Portnoy

Re: HP Jetdirect Printers and portscans Fred Portnoy (Jun 29)

Fyodor

Re: Patch for stick Fyodor (May 08)
Re: [Snort-devel] When will snort be offically released? Fyodor (May 07)
Re: Snort logging to Oracle Fyodor (May 24)
Re: Compile under Linux kernel 2.4.3 Fyodor (Jun 15)
Re: Snort 1.7 problem with -i any Fyodor (Jun 05)
Re: Libnet & 'resp' Fyodor (Jun 21)
Re: Getting One instance of snort to sniff 2 interfaces Fyodor (May 01)
Re: Watching MAC addresses instead of IP's Fyodor (May 19)
Re: Starting snort against multiple interfaces? Fyodor (Jun 19)
Re: DoD plugin? Fyodor (Apr 30)
Re: Libnet & 'resp' Fyodor (Jun 27)
Re: help with snort Fyodor (May 20)
Re: [Fwd: Several Misbehaviors with the ICMP implementation (and the 'ping'utility) with MS based operating systems] Fyodor (May 06)
Re: Repost: Syslog, but I don't want it Fyodor (Jun 02)
Re: Snort and Ethereal Fyodor (May 05)
Re: Snort vs TCPdump Fyodor (Jun 02)
Re: {off-topic} Who goes 2 Defcon9 Fyodor (Jun 02)
Re: DoD plugin Fyodor (May 01)
Re: Snort basic questions Fyodor (Jun 10)
Re: Memory leak Fyodor (May 03)
Re: Libnet & 'resp' Fyodor (Jun 21)
Re: [!] WARNING: Not IPv4 datagram! - huh? Fyodor (May 27)
Re: Range values for TTL Fyodor (May 06)
Re: Re: snort and aix Fyodor (May 07)

Galileo

Snort + Acid + lots of data Galileo (May 12)

Galitz

GRC.com attack and TCP stacks Galitz (Jun 22)

GaRaGeD

any program like guardian? (for iptables) GaRaGeD (Jun 24)

Garreth Jeremiah

Sub-7 Scans Garreth Jeremiah (May 23)
mySQLis built Garreth Jeremiah (May 21)
Snort Dump Core Garreth Jeremiah (May 30)

GeEk

Re: Merging new rules GeEk (Jun 18)
Re: Stopping particular rules GeEk (Jun 25)

[Genocide]

Re: What does "VNC active on network" mean [Genocide] (May 09)
Re: What does "VNC active on network" mean [Genocide] (May 09)

Geoff the UNIX guy

spoof detection in snort Geoff the UNIX guy (Apr 29)

George Yobst

Re: Newbie: Bot Detection Rule George Yobst (Jun 21)
Newbie: Bot Detection Rule George Yobst (Jun 21)

Ginnetty, James

RE: Whitehats rules don't work Ginnetty, James (Jun 04)

Gisli Helgason

Problem running snortsnarf Gisli Helgason (Jun 18)

Graeme Fowler

RE: When is a hub not a hub? (AuthReply) Graeme Fowler (Jun 07)
RE: Recall: Error trying to read in tcpdump file Graeme Fowler (Jun 12)
RE: netbios-name-query Graeme Fowler (Jun 11)
Recall: Error trying to read in tcpdump file Graeme Fowler (Jun 12)

Graham M Locke

RE: catch all rule Graham M Locke (Jun 19)
Re: Content "c:" Graham M Locke (Jun 20)

grantp

Re: snort trips.. grantp (Jun 18)

Grant Parkinson

Re: Stop creating address directories? Grant Parkinson (Jun 12)
Re: snort 1.8 beta6 build26 Grant Parkinson (Jun 24)
Re: commenting out rules? Grant Parkinson (Jun 16)
Re: loggin to mySQL Grant Parkinson (Jun 17)
Re: Meaning of exploit logs Grant Parkinson (Jun 12)
Re: Promiscious mode required? Grant Parkinson (Jun 13)

Gregor Binder

Re: eri* on Netra's Gregor Binder (May 04)

Gregory Mingus

RE: php --with-gd Gregory Mingus (May 15)
RE: logging question Gregory Mingus (May 25)
Intermittent syslog error Gregory Mingus (Jun 25)

Greg Wright

RE: 1.8? Greg Wright (Jun 04)
WinPCAP Error Greg Wright (Jun 07)
RE: iis5 printer isapi filter signatures Greg Wright (May 02)
RE: IDScenter - windows GUI front end for Windows S nort Greg Wright (May 03)

Guillaume

Re: loggin to mySQL Guillaume (Jun 17)
Re: snort attacks Guillaume (May 29)
Re: reg snort Guillaume (Jun 25)
Portscan Preprocessor... Guillaume (May 09)
Max Vision... Guillaume (May 09)

Guy Fighel

Snort & email Guy Fighel (May 15)

HABU Takuya

Stick and Segmentation Fault HABU Takuya (Jun 15)
Is Stick not dangerous? HABU Takuya (Jun 24)
Re: Rule IP addr (!192.168.1.1) didn't x-late, WTF? HABU Takuya (Jun 26)

Hallawell, Samuel J

[**] WEB-MISC prefix-get // [**] Hallawell, Samuel J (Apr 30)

Hawrylkiw, Dan G

RE: Snort and Firewall on the same box Hawrylkiw, Dan G (May 14)
RE: snort behind firewall ?? Hawrylkiw, Dan G (May 02)
RE: Snort behind host's firewall Hawrylkiw, Dan G (Jun 08)

H C

Win32-snort 1.8 H C (May 07)

H D Moore

Re: Remote location H D Moore (May 15)
Re: At configure: No such file or directory H D Moore (May 13)
Re: At configure: No such file or directory H D Moore (May 12)
1.8b5 build22 crash H D Moore (May 12)
Re: Port 10008/tcp ? H D Moore (May 15)
Re: Shellcode x86 setgid 0 H D Moore (May 13)

Henrik Anmarkrud

not logging?? Henrik Anmarkrud (May 20)

Henrik Sandklef

Syntax for alert_unixsock Henrik Sandklef (Jun 08)

Henry Sieff

RE: Check out how Microsoft hacks... :) Henry Sieff (May 01)

holger.bumke

Antwort: DNS Query Logging? holger.bumke (May 11)

Horacio Fernandes

(no subject) Horacio Fernandes (Apr 30)

Horst . Raditschnigg

Horst Raditschnigg/Dueren/ISOLA ist außer Haus. Horst . Raditschnigg (May 23)
Horst Raditschnigg/Dueren/ISOLA ist außer Haus. Horst . Raditschnigg (May 24)
Horst Raditschnigg/Dueren/ISOLA ist außer Haus. Horst . Raditschnigg (May 24)

Ian Jones

Linux worm: stuff.tgz, CHAOS/TXT Ian Jones (Jun 23)
snort email, beta testers please Ian Jones (May 14)
[ACID] - trying to keep up Ian Jones (Jun 21)
Re: [ACID] - trying to keep up Ian Jones (Jun 25)
Re: snort email, beta testers please Ian Jones (May 15)

ICPPhila_Email_Review

Re: Possible DOS Attack?? ICPPhila_Email_Review (Jun 19)
Re: Possible DOS Attack?? ICPPhila_Email_Review (Jun 19)

iddwb

xml plugging docs iddwb (May 25)

Ilmarinen

snort + daemontools + chroot + remote mysql Ilmarinen (Jun 27)

info . sec

Can I stop these port 53 detects? info . sec (Jun 21)

izink

Re: Getting One instance of snort to sniff 2 interfaces izink (May 02)
Getting One instance of snort to sniff 2 interfaces izink (Apr 30)

jabacha

Re: snort 1.7 on suse6.3 quitting jabacha (Jun 02)
RE: snort 1.7 on suse6.3 quitting jabacha (Jun 03)
snort 1.7 on suse6.3 quitting jabacha (May 31)

James Friesen

Newbie setup question James Friesen (Jun 14)
Newbie setup question James Friesen (Jun 16)

James Hoagland

SnortSnarf version 052301.1 James Hoagland (May 23)
[Snortsnarf] SnortSnarf version 052101.1 James Hoagland (May 21)
RE: logging question James Hoagland (May 29)
Re: Problem running snortsnarf James Hoagland (Jun 20)
SnortSnarf version 051601.1 James Hoagland (May 16)
Are you using Spade? James Hoagland (Jun 20)
RE: -o and pass/alert/log usage James Hoagland (Jun 28)
Re: spade reports James Hoagland (Jun 17)

James R. Hendrick

simple question on packet sizes James R. Hendrick (May 08)

jan

RE: snort on stealth mode jan (May 31)
RE: Assign NO ip addr to interface jan (Jun 14)
RE: Assign NO ip addr to interface jan (Jun 14)
RE: Newbie Questions jan (Jun 18)
RE: ICMP logs jan (May 25)
ICMP logs jan (May 25)
RE: logging question jan (May 25)
Re: ICMP logs jan (May 25)

Jari Pirhonen

multiple sensors, one db Jari Pirhonen (May 22)

Jason Costomiris

snort 1.7+mysql+acid == headaches. pass the aspirin? (long) Jason Costomiris (May 11)

Jason Haar

Re: The lack of a "client" and "server" definition in snort... Jason Haar (Jun 06)
The lack of a "client" and "server" definition in snort... Jason Haar (Jun 05)
Re: spoof detection in snort Jason Haar (Apr 29)
mem leak in snort-1.8-beta5 from 31-May CVS Jason Haar (May 31)
Query about description of SSL option in configure Jason Haar (May 02)

Jason Johndrow

Re: 3rd Party Snort Stuff Jason Johndrow (May 01)

Jason Lewis

Snort Install Doc Jason Lewis (Jun 25)
RE: Snort reporting and alerting Jason Lewis (May 28)
RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Jason Lewis (Jun 27)
Error in Acid Jason Lewis (May 05)
RE: Port 10008/tcp ? Jason Lewis (May 15)
RE: snort+acid (graphic alert data) Jason Lewis (May 23)
RE: Error trying to read in tcpdump file Jason Lewis (Jun 12)
RE: snort 1.7 on suse6.3 quitting Jason Lewis (Jun 02)
RE: Snort Install Doc Jason Lewis (Jun 27)
Snort in the Enterprise Jason Lewis (May 07)
RE: Error trying to read in tcpdump file Jason Lewis (Jun 11)
RE: snort behind firewall ?? Jason Lewis (Apr 30)
RE: Snort behind host's firewall Jason Lewis (Jun 08)
RE: log Jason Lewis (May 15)
RE: Snort Install Doc Jason Lewis (Jun 27)
RE: Snort detecting attacks... Jason Lewis (May 20)
RE: Tcpdump, alerts and portscans Jason Lewis (Jun 25)
RE: Guardian Jason Lewis (Jun 11)
RE: Error trying to read in tcpdump file Jason Lewis (Jun 12)
Tcpdump, alerts and portscans Jason Lewis (Jun 24)
RE: Tcpdump, alerts and portscans Jason Lewis (Jun 25)
RE: Error in acid-0.9.6b9 Jason Lewis (May 13)
Is there an expected date for 1.8? Jason Lewis (Apr 29)
RE: Tcpdump, alerts and portscans Jason Lewis (Jun 25)
RE: advice on scaling / performance Jason Lewis (Jun 19)
RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Jason Lewis (Jun 26)
Snort Install Doc Update Jason Lewis (Jun 27)
RE: loggin to mySQL Jason Lewis (Jun 17)
RE: Tcpdump, alerts and portscans Jason Lewis (Jun 25)
RE: Tcpdump, alerts and portscans Jason Lewis (Jun 25)
Error trying to read in tcpdump file Jason Lewis (Jun 11)

Jason M. Frey

Snort XML Output Jason M. Frey (Jun 04)

Jason Oakley

port 1104 multiple scans Jason Oakley (Jun 21)
Meaning of exploit logs Jason Oakley (Jun 12)

Jason Opperisano

RE: snort behind firewall ?? Jason Opperisano (May 01)

Jason Robertson

Re: GRC.com attack and TCP stacks Jason Robertson (Jun 24)

Jay Moore

Possible DOS Attack?? Jay Moore (Jun 18)
CVS or 1.7? Jay Moore (Jun 11)

Jean-Francois Zwobada

RE: Rules vs performance Jean-Francois Zwobada (May 11)

Jean sébastien Op de Beeck

Snort vs TCPdump Jean sébastien Op de Beeck (May 30)

Jed Haile

Re: The lack of a "client" and "server" definition in snort... Jed Haile (Jun 05)
Re: simple quick question Jed Haile (Jun 14)
Re: {off-topic} Who goes 2 Defcon9 Jed Haile (Jun 05)

Jed Pickel

Re: SnortDB schema vs. Snort XML schema. Jed Pickel (Jun 15)

Jeff Bigley

testing snort Jeff Bigley (Jun 26)

Jeff Dell

RE: Call for features requests for SPPv2 Jeff Dell (May 15)
RE: Rule Managment Tool Jeff Dell (May 10)
RE: Rule Managment Tool Jeff Dell (May 10)
IDS Policy Manager Jeff Dell (Jun 10)
RE: Rule Managment Tool Jeff Dell (May 10)

Jeffrey W. Collyer

ACID Error -- no snort.signature table Jeffrey W. Collyer (May 08)

Jenkinson, John P (SAIC)

VECNA name Jenkinson, John P (SAIC) (Jun 25)

Jerry Shenk

RE: IDScenter - windows GUI front end for Windows Snort Jerry Shenk (May 03)
IDScenter - windows GUI front end for Windows Snort Jerry Shenk (May 03)
RE: IDScenter - windows GUI front end for Windows Snort Jerry Shenk (May 03)
RE: OT: "Pretty Packet Printer" Jerry Shenk (May 08)

jess

TCP Window Question jess (Jun 01)

Jev

Watching MAC addresses instead of IP's Jev (May 19)

Jihoon Chung

Syslog and SMB popup at the same time? Jihoon Chung (May 14)

Jim

Updated Snort_log_rotate script Jim (Jun 02)

Jim Forster

Re: Remote location Jim Forster (May 16)
Just FYI Jim Forster (May 03)
Fw: any question [need help] Jim Forster (Jun 04)
Re: What does "VNC active on network" mean Jim Forster (May 09)

Jim Kipp

Logging Question Jim Kipp (Jun 11)

Jim lee

Request for help Jim lee (Jun 14)

Jim Schwin

HomeNet Jim Schwin (Jun 22)

jjaime

Too many ICMP Destination Unreachable (Port Unreachable) jjaime (Jun 22)

Joe Barr

Does ECN trigger alarms? Joe Barr (May 22)

Joe Fico

RE: -o and pass/alert/log usage Joe Fico (Jun 27)
-o and pass/alert/log usage Joe Fico (Jun 26)
FW: -o and pass/alert/log usage Joe Fico (Jun 27)

Joe Lawson

Large increase in ICMP Trace route alerts Joe Lawson (May 17)

Joe McAlerney

Re: getcontact utility Joe McAlerney (Jun 19)
IDMEF XML plugin 0.2 Joe McAlerney (Jun 01)
Re: Portscan Preprocessor... Joe McAlerney (May 09)
Re: Problem with resp Joe McAlerney (May 22)
Re: -o and pass/alert/log usage Joe McAlerney (Jun 27)
Re: [Snort-devel] Snort logging to Oracle Joe McAlerney (May 24)
Re: HP Jetdirect Printers and portscans Joe McAlerney (Jun 29)
Re: Libnet & 'resp' Joe McAlerney (Jun 20)
Re: Stopping particular rules Joe McAlerney (Jun 25)
Re: How to install snort on Windows 2000? Joe McAlerney (Jun 20)
Re: [Snort-devel] classification changes Joe McAlerney (May 23)
Re: Snort & Reset Connection - How to? Joe McAlerney (Jun 20)
Re: Snort newbie Joe McAlerney (May 10)
Re: ruletype doesn't work at all ?! Joe McAlerney (May 22)
Re: Repost: Syslog, but I don't want it Joe McAlerney (May 31)
Re: VECNA name Joe McAlerney (Jun 25)
Re: BPF for ECN Bits Joe McAlerney (May 24)
Re: Snort XML Output Joe McAlerney (Jun 05)
Re: snort detects portscan? Joe McAlerney (Jun 19)
Re: Alert on more than 1 rule? Joe McAlerney (Jun 25)

Johan Simon Seland

Re: Snort 1.7 dies on OpenBSD 2.9 after some time. Johan Simon Seland (Jun 21)
Re: Snort 1.7 dies on OpenBSD 2.9 after some time. Johan Simon Seland (Jun 20)
Snort 1.7 dies on OpenBSD 2.9 after some time. Johan Simon Seland (Jun 20)
Re: Snort 1.7 dies on OpenBSD 2.9 after some time. Johan Simon Seland (Jun 22)

John Berkers

Snort and IPChains John Berkers (Apr 30)
RE: Call for features requests for SPPv2 John Berkers (May 16)
RE: Portscan from own interface John Berkers (May 16)
Snort daily tarball John Berkers (May 16)
RE: Portscan preprocessor tweaking John Berkers (May 16)
RE: First time in NIDS mode, and... John Berkers (May 16)

John Bradberry

Re: core dumped John Bradberry (May 30)

John Johnson

snort 1.7 and alerts John Johnson (May 31)
False alerts John Johnson (May 29)
spp_http_decode: CGI Null Byte attack detected John Johnson (May 29)

John Sage

Re: snort & logging John Sage (Jun 11)
Re: At configure: No such file or directory John Sage (May 13)
Re: Hardcore -r question John Sage (Jun 12)
First time in NIDS mode, and... John Sage (May 16)
the most cryptic fsck'ing thing... John Sage (May 19)
Re: Syslog trouble John Sage (May 30)
Where does Snort sit... John Sage (May 13)
Hardcore -r question John Sage (Jun 11)
Re: Name resolution John Sage (May 18)
[!] WARNING: Not IPv4 datagram! - huh? John Sage (May 27)
Re: Hardcore -r question John Sage (Jun 11)
snort not seeing udp through ppp0? John Sage (May 21)
Re: Problem using snort John Sage (May 20)
Discarded packets and other stats... John Sage (Jun 18)
Re: Where does Snort sit... John Sage (May 13)
Re: [Snort-users] John Sage (Jun 11)
Re: the most cryptic fsck'ing thing... John Sage (May 20)
Re: At configure: No such file or directory John Sage (May 12)
Re: How to review actual packets? John Sage (Jun 11)
Re: [!] WARNING: Not IPv4 datagram! - huh? John Sage (May 27)
Re: the most cryptic fsck'ing thing... John Sage (May 20)
At configure: No such file or directory John Sage (May 12)
Re: First time in NIDS mode, and... John Sage (May 16)
Re: Some assistance with Snort? John Sage (May 27)
Re: Syslog trouble John Sage (May 30)
Re: Newbie questions: logs John Sage (Jun 11)
Fix: Re: Problem using snort John Sage (May 20)

Johnson, David

ICMP alerts from broadcast? Johnson, David (May 31)
RE: Problems. Johnson, David (Jun 25)
RE: Newbie Question... Please forgive...... Johnson, David (Jun 06)
ICMP alerts from broadcast? Johnson, David (May 31)
RE: snort on Win2k Johnson, David (May 22)
RE: testing snort Johnson, David (Jun 27)
RE: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Johnson, David (Jun 27)

Jonathan G. Lampe

When is a hub not a hub? Jonathan G. Lampe (Jun 05)
Rule to detect "well-behaved" multicast packets Jonathan G. Lampe (Jun 05)
When is a hub not a hub? (AuthReply) Jonathan G. Lampe (Jun 05)

Jon Bentley

Re: High CPU Jon Bentley (May 10)

Jones, Benny

RE: binary log? Jones, Benny (May 25)
logging question (-b or not -b) Jones, Benny (May 16)
What does "VNC active on network" mean Jones, Benny (May 09)
Broadscan Smurf Scanner Jones, Benny (May 11)
RE: Snort Install Doc Jones, Benny (Jun 27)

Jon Tollerton

RE: Re: HP Jetdirect Printers and portscans Jon Tollerton (Jun 29)

Joseph Nicholas Yarbrough

Re: advice on scaling / performance Joseph Nicholas Yarbrough (Jun 19)
advice on scaling / performance Joseph Nicholas Yarbrough (Jun 19)

Josh Gentry

spade reports Josh Gentry (Jun 16)

Josh Oshiro

Re: snort behind firewall ?? Josh Oshiro (Apr 30)
Re: Getting One instance of snort to sniff 2 interfaces Josh Oshiro (May 02)
Re: Getting One instance of snort to sniff 2 interfaces Josh Oshiro (Apr 30)

Joshua Stein

Re: Read-Only Ethernet cable Joshua Stein (Jun 19)
Re: UDP is all I see.. Joshua Stein (May 16)
Re: snort+acid (graphic alert data) Joshua Stein (May 23)
Re: Check out how Microsoft hacks... :) Joshua Stein (May 01)

Joshua Wright

RE: Snort logging to Oracle Joshua Wright (May 24)

Julio Jaime

Newbie question. Julio Jaime (Jun 13)

Jürgen Nieveler

RE: IDScenter - windows GUI front end for Windows S nort Jürgen Nieveler (May 04)
RE: IDScenter - windows GUI front end for Windows S nort Jürgen Nieveler (May 03)

Keith A. Pachulski, PPS

(no subject) Keith A. Pachulski, PPS (Jun 08)

Keith Woodworth

Re: SIGHUP results in exit(1) Keith Woodworth (May 26)
New to snort, need suggestion. Keith Woodworth (May 11)
Re: Some assistance with Snort? Keith Woodworth (May 27)
(no subject) Keith Woodworth (Jun 04)

Kelly Fallon

RE: ACID: Outer Join Not Supported Kelly Fallon (May 24)
RE: ACID: Outer Join Not Supported Kelly Fallon (May 24)

Kendall Lister

Re: Name resolution Kendall Lister (May 17)

Kent E. Parkin

rules error Kent E. Parkin (Jun 12)

Kevin . Brown

RE: mem leak and dead snort on Sun Kevin . Brown (May 15)
RE: Slightly OT - Re: My apologies Kevin . Brown (May 11)
RE: Boneheaded CVS update question Kevin . Brown (May 15)
mem leak and dead snort on Sun Kevin . Brown (May 14)
My apologies Kevin . Brown (May 10)
RE: php --with-gd won't compile Kevin . Brown (May 15)

Kevin Brown

RE: Rules vs performance Kevin Brown (May 10)
RE: Error 43? Kevin Brown (May 25)
RE: Help Kevin Brown (May 23)
Anyone else seen this? Kevin Brown (Jun 14)
RE: Vision rules EXTERNAL/EXTERNAL_NET Kevin Brown (May 16)
RE: Anyone else seen this? Kevin Brown (Jun 18)
eri* on Netra's Kevin Brown (May 04)
RE: ACID: Outer Join Not Supported Kevin Brown (May 23)
RE: Snort won't run Kevin Brown (May 10)
ACID: Outer Join Not Supported Kevin Brown (May 23)
RE: New Conundrum Kevin Brown (May 10)
New Conundrum Kevin Brown (May 09)
RE: spp_portscan Kevin Brown (Jun 22)
RE: ACID: Outer Join Not Supported Kevin Brown (May 24)
RE: Anyone else seen this? Kevin Brown (Jun 19)
RE: [Snort-users] Horst Raditschnigg/Dueren/ISOLA ist außer Haus. Kevin Brown (May 24)
RE: eri* on Netra's Kevin Brown (May 04)
RE: ACID Kevin Brown (May 04)
RE: eri* on Netra's Kevin Brown (May 04)
RE: Multiple Interfaces... Kevin Brown (May 17)
RE: Help Kevin Brown (May 23)

Kevin Pietersma

Re: Command line Acid. Kevin Pietersma (May 22)
bcmath and ACID Kevin Pietersma (Jun 25)

KFC

Can Snort Dectec R2L attack? KFC (Jun 04)

khaled Aly axan

help with snort khaled Aly axan (May 20)

Kiira Triea

latest acid for snort 1.8? Kiira Triea (Jun 27)
Re: odd output plugin behavior? Kiira Triea (Jun 19)
ACID and postgres: 7.1+ ??? Kiira Triea (Jun 12)
Re: Starting snort against multiple interfaces? Kiira Triea (Jun 19)
RE: Stopping particular rules Kiira Triea (Jun 25)
Re: >2Gb capture files Kiira Triea (Jun 25)
Starting snort against multiple interfaces? Kiira Triea (Jun 19)
odd output plugin behavior? Kiira Triea (Jun 19)

Kistler Ueli

IDScenter 1.08d is out! Kistler Ueli (Jun 24)
IDScenter 1.08c is out! - NEW: E-mail alerts Kistler Ueli (May 29)

Koaps

Re: Snort + Acid w/ MySQL question(s) Koaps (May 10)
loggin issue Koaps (May 10)

Kohlenberg, Toby

Reloading snort rules on the fly? Kohlenberg, Toby (Jun 22)
RE: alarm levels assigned to Snort rules Kohlenberg, Toby (Jun 26)

Kris Quinby

RE: Centralized DB Server?? Kris Quinby (Jun 12)

Lai Zit Seng

Subnet list in HOME_NET affects performance? Lai Zit Seng (Jun 12)

Lampe, John W.

RE: TCP Reset Lampe, John W. (May 19)
RE: TCP Reset Lampe, John W. (May 20)

Lance Spitzner

Re: Intro to Snort Lance Spitzner (May 01)
Re: Shellcode x86 setgid 0 Lance Spitzner (May 13)

LaraCroft

Ignore some ip's LaraCroft (Jun 27)

Larry Chuon

ACID Larry Chuon (May 03)
RE:Acid Larry Chuon (May 06)

Leandro Asnaghi-Nicastro

Snort. Leandro Asnaghi-Nicastro (Jun 12)
A little confused. Leandro Asnaghi-Nicastro (Jun 15)
Installing Snort on Slackware kernel 2.2.16 Leandro Asnaghi-Nicastro (Jun 13)

Lee Smallbone

Re[2]: performance snort question Lee Smallbone (Jun 19)
Re[2]: performance snort question Lee Smallbone (Jun 19)
Re[2]: performance snort question Lee Smallbone (Jun 19)

LEFEVRE David

Re: Port 10008?? LEFEVRE David (Jun 06)
Re: Is there a complete PORT list online? LEFEVRE David (Jun 06)
Re: rpc.statd LEFEVRE David (Jun 06)

Louie Martinez

Snort and IPTables? Louie Martinez (Jun 11)

Lucie Hall

Snort & Reset Connection - How to? Lucie Hall (Jun 20)
Checkpoint FW-1 Lucie Hall (Jun 20)

Mads Krog-Jensen

Portscan detection Mads Krog-Jensen (May 23)
CPU usage Mads Krog-Jensen (May 28)

Mailer-Daemon

Message status - undeliverable Mailer-Daemon (Jun 27)

manoj

snort on stealth mode manoj (May 31)

Marc Thompson

RE: FW: [ACID Newcomer] snort.signature table not a vail Marc Thompson (May 24)
RE: Centralized DB Server?? Marc Thompson (Jun 12)
Repost: Syslog, but I don't want it Marc Thompson (May 31)
[ACID Newcomer] snort.signature table not available error Marc Thompson (May 24)
RE: Centralized DB Server?? Marc Thompson (Jun 12)
RE: Repost: Syslog, but I don't want it Marc Thompson (Jun 03)
Centralized DB Server?? Marc Thompson (Jun 11)
Syslog, but I don't want it Marc Thompson (May 30)
RE: Centralized DB Server?? Marc Thompson (Jun 12)
RE: Repost: Syslog, but I don't want it Marc Thompson (Jun 01)
RE: [Newbie] pppoe Marc Thompson (Jun 07)
RE: Repost: Syslog, but I don't want it Marc Thompson (Jun 01)
RE: snort, mysql configs Marc Thompson (Jun 13)

mark

multiple DNS servers mark (Jun 07)

Mark A Lewis

Re: Show alerts on console? Mark A Lewis (Apr 29)
Show alerts on console? Mark A Lewis (Apr 29)

Mark Andrich

Was Newbie question: Thank you..... Mark Andrich (Jun 06)
Newbie Question... Please forgive...... Mark Andrich (Jun 06)
Snort Win32 Mark Andrich (Jun 15)

Mark Evans

RE: Hardcore -r question Mark Evans (Jun 12)

Mark Rowlands

Re: Snort 1.8 Beta5 Build 24 - Leak Mark Rowlands (May 15)

Mark W. Davis

RE: How can I setup Snort to e-mail alerts? Mark W. Davis (Jun 22)

Martijn Heemels

RE: snort behind firewall ?? Martijn Heemels (May 01)

Martin Roesch

Re: Snort 1.8-beta4 Build 17 coredump Martin Roesch (May 11)
Re: http_decode alerts bypassing "pass" rules Martin Roesch (May 22)
Re: Stream4 and other stuff Martin Roesch (Jun 29)
Re: error with rulesets Martin Roesch (May 06)
Re: Stream4 and other stuff Martin Roesch (Jun 29)
Re: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Martin Roesch (Jun 27)
Re: testing from same machine? Martin Roesch (May 06)
Re: Hardcore -r question Martin Roesch (Jun 11)
Re: the 1.7 ruleset files dont work Martin Roesch (May 05)
Re: Revamp ->unaligned trap, sorry previously vague Martin Roesch (May 06)
Re: Snort with enable-debug doesn't log Martin Roesch (May 06)
Re: Problem compiling source from cvs Martin Roesch (Jun 13)
Re: redundant rules Martin Roesch (May 10)
Re: config classification - is this for snort-1.8? Martin Roesch (May 06)
Re: Stop creating address directories? Martin Roesch (Jun 12)
Re: Memory leak Martin Roesch (May 03)
Re: Error trying to read in tcpdump file Martin Roesch (Jun 12)
Re: Snort 1.8 more CPU intensive? Martin Roesch (May 06)
Re: Memory leak Martin Roesch (Jun 02)
Re: Memory leak Martin Roesch (May 03)
Re: Snorth 1.8 to incl. AC-BM Algorithm? Martin Roesch (May 09)
Re: [Snort-devel] When will snort be offically released? Martin Roesch (Jun 02)
Re: mem leak in snort-1.8-beta5 from 31-May CVS Martin Roesch (May 31)
Re: simple question on packet sizes Martin Roesch (May 27)
Stream4 and other stuff Martin Roesch (Jun 28)
Re: New Problem Martin Roesch (May 06)
Re: -N switch fails? Martin Roesch (Jun 14)
Re: Memory leak Martin Roesch (May 03)
Re: RE: [Snort-users] Horst Raditschnigg/Dueren/ISOLA ist außer Haus. Martin Roesch (May 24)
Re: Win32-snort 1.8 Martin Roesch (May 07)
No, I'm not dead Martin Roesch (Jun 02)
Re: [Fwd: Several Misbehaviors with the ICMP implementation (and the'ping'utility) with MS based operating systems] Martin Roesch (May 06)
Re: ******unsubscribe****** Martin Roesch (May 10)
Re: Error trying to read in tcpdump file Martin Roesch (Jun 11)
Re: Memory leak Martin Roesch (May 03)
Re: Is this a realy a bogus portscan report? Martin Roesch (May 07)
Re: [Snort-devel] When will snort be offically released? Martin Roesch (May 06)
Re: Re: [Snort-devel] When will snort be offically released? Martin Roesch (May 07)
Re: Patch for stick Martin Roesch (May 27)
Re: BIND signature triggered. Martin Roesch (Apr 29)
Re: What does lightweight mean? Martin Roesch (May 30)
Re: {off-topic} Who goes 2 Defcon9 Martin Roesch (Jun 03)
Re: Re: unsubscribe (Curbside Service) Martin Roesch (May 11)
Re: What does lightweight mean? Martin Roesch (May 30)
Re: [Snort-announce] run snort on GRE tunnel interface? Martin Roesch (Jun 26)
Re: 1.8beta4 and "Classification" garbage Martin Roesch (May 06)
Re: Training info? Martin Roesch (May 06)
Re: Snorts competition falling like flies Martin Roesch (May 22)
Re: 1.8b5 build22 crash Martin Roesch (May 12)
Re: Snort log Martin Roesch (May 06)
Re: spo_database oddity Martin Roesch (May 04)
Re: binary log? Martin Roesch (May 25)
Re: Error trying to read in tcpdump file Martin Roesch (Jun 12)
FYI Martin Roesch (May 16)
Re: Tcpdump, alerts and portscans Martin Roesch (Jun 25)
Re: Stream4 and other stuff Martin Roesch (Jun 29)
Re: Stream4 and other stuff Martin Roesch (Jun 29)
Re: Docs for snort-1.8 Martin Roesch (May 27)
Re: 'FSM compilation failed' Martin Roesch (May 22)
Re: Intro to Snort Martin Roesch (May 06)

Matt Hand

chameleon overflow Matt Hand (Jun 08)

Matthew Asham

strange firewall rules, messing with snort Matthew Asham (Jun 19)

Matthew Collins

Re: Logging packet contents in alerts. Matthew Collins (Jun 07)
Logging packet contents in alerts. Matthew Collins (Jun 06)
Re: ICMP Echo Replies & Unknowns? Matthew Collins (Jun 28)
Re: chameleon overflow Matthew Collins (Jun 11)
Re: >2Gb capture files Matthew Collins (Jun 25)
Re: netbios-name-query Matthew Collins (Jun 11)
Re: Stream4 and other stuff Matthew Collins (Jun 29)
Re: Updated Snort_log_rotate script Matthew Collins (Jun 04)

Matt Scarborough

Re:A new type of ICMP packet Matt Scarborough (May 28)
Re: Wierd Packets, ICMP Dest Unreachable Matt Scarborough (Jun 14)
Re: A new type of ICMP packet Matt Scarborough (May 29)

Matt Watchinski

Re: GRC.com attack and TCP stacks Matt Watchinski (Jun 24)

Max Vision

iis5 printer isapi filter signatures Max Vision (May 02)
Re: Whitehats rules work :) (was Re: Whitehats rules don't work) Max Vision (Jun 05)
no of course not (was Re: Is whitehats.com/arachnids gone?) Max Vision (Jun 12)
Re: Range values for TTL Max Vision (May 06)
Whitehats rules work :) (was Re: Whitehats rules don't work) Max Vision (Jun 05)
Re: classification changes Max Vision (May 23)
RE: snort attacks Max Vision (May 29)
Re: [Fwd: Several Misbehaviors with the ICMP implementation (and the 'ping'utility) with MS based operating systems] Max Vision (May 06)
Re: BPF for ECN Bits Max Vision (May 24)
Re: Patch for stick Max Vision (May 07)
Re: Whitehats rules don't work Max Vision (Jun 04)
cachemgr.cgi Max Vision (Jun 25)
Re: sadmind rule Max Vision (May 09)
Re: What am I missing? Max Vision (May 05)
Re: snort attacks Max Vision (May 29)

Mayers, Philip J

RE: ACID: Outer Join Not Supported Mayers, Philip J (May 24)
FW: NetFlow output plugin? Mayers, Philip J (May 11)
NetFlow output plugin? Mayers, Philip J (May 11)
RE: Hub not a hub Mayers, Philip J (Jun 06)
RE: >2Gb capture files Mayers, Philip J (Jun 26)
Snort 1.8 more CPU intensive? Mayers, Philip J (May 02)
>2Gb capture files Mayers, Philip J (Jun 25)
RE: Stream4 and other stuff Mayers, Philip J (Jun 29)
RE: Stream4 and other stuff Mayers, Philip J (Jun 29)
RE: Stream4 and other stuff Mayers, Philip J (Jun 29)
RE: GRC.com attack and TCP stacks Mayers, Philip J (Jun 25)

Michael Aylor

Email using mysql Michael Aylor (May 07)
Delete Sensor from MySql Database Michael Aylor (May 22)
snort-shadow - two great tastes that go together Michael Aylor (May 09)
FW: Delete Sensor from MySql Database Michael Aylor (May 22)

Michael Davis

Re: v1.7 syslog.c Win32 conversion error - Incorrect date parameters Michael Davis (May 28)
Re: WinPCAP Error Michael Davis (Jun 08)

Michael J Clark

Re: Syslog trouble Michael J Clark (May 30)
Syslog trouble Michael J Clark (May 29)

michael . porter

TCP Reset michael . porter (May 19)
RE: TCP Reset michael . porter (May 20)
RE: TCP Reset michael . porter (May 20)

Michael Steele

RE: How to install snort on Windows 2000? Michael Steele (Jun 21)
RE: [Fwd: Error: unable to open local.rules] Michael Steele (Jun 13)
RE: How to install snort on Windows 2000? Michael Steele (Jun 21)
Winsows Snort Support Michael Steele (Jun 09)
RE: Newbie setup question Michael Steele (Jun 20)
RE: [Fwd: Error: unable to open local.rules] Michael Steele (Jun 13)
RE: Redhat webserver setup Michael Steele (Jun 13)

Michel A. S. Pereira - KIDMumU[InTrance]

Alert by email Michel A. S. Pereira - KIDMumU[InTrance] (May 16)

Midnight shadow

Re: Portscan from own interface Midnight shadow (May 16)
Portscan from own interface Midnight shadow (May 10)
Re: Portscan from own interface Midnight shadow (May 16)

Mike Grundy

Re: snort on OS/390? Mike Grundy (May 29)

mike huang

Help with Adapter mike huang (May 17)

Mike Johnson

Snort with postgresql on OpenBSD2.9 (snapshot) Mike Johnson (May 20)
Re: Hub not a hub Mike Johnson (Jun 05)
Re: Re: [Snort-devel] classification changes Mike Johnson (May 23)
Re: Snort with postgresql on OpenBSD2.9 (snapshot) Mike Johnson (May 20)

Mohamed Sentissi

this is strange Mohamed Sentissi (May 09)
problems getting logs :( Mohamed Sentissi (May 09)

moran

snort with mysql moran (May 02)
is it possible moran (May 15)
IIS Unicode attack moran (May 01)

Murphy, Brendan

DB configuration Murphy, Brendan (May 07)

Nalneesh Gaur

Logging UNICOIDE Nalneesh Gaur (May 21)

Neal Timm

RE: any program like guardian? (for iptables) Neal Timm (Jun 25)
Guardian Neal Timm (Jun 11)
Guardian Neal Timm (Jun 13)
Guardian Neal Timm (Jun 11)
Guardian Neal Timm (Jun 15)

Neil Dickey

Re: ICMP logs Neil Dickey (May 25)
RE: AOL Instant Messenger signature? Neil Dickey (May 01)
RE: AOL Instant Messenger signature? Neil Dickey (May 01)
Re: Snort Rules Neil Dickey (Jun 07)
Re: binary log? Neil Dickey (May 25)
Wierd Packets, was: Snort dumps core on Solaris 8 Neil Dickey (Jun 07)
Re: Port 10008/tcp ? Neil Dickey (May 15)
Re: Snort 1.7 problem with -i any Neil Dickey (Jun 04)
Re: Error in snort start (Duplicate processor keyword) Neil Dickey (May 18)
Re: http_decode alerts bypassing "pass" rules Neil Dickey (May 09)
Re: Portscan detection Neil Dickey (May 23)
RE: Repost: Syslog, but I don't want it Neil Dickey (Jun 01)
Re: Snort 1.7 problem with -i any Neil Dickey (Jun 05)
RE: Arghh...how do I stop it doing this!! Neil Dickey (May 03)
"Destination Unreachable" flags Neil Dickey (May 31)
Re: IIS Unicode attack Neil Dickey (May 01)
Re: Re: unsubscribe (Curbside Service) Neil Dickey (May 11)
Re: how to ignore scans from trusted hosts? Neil Dickey (Jun 01)
RE: Repost: Syslog, but I don't want it Neil Dickey (Jun 01)
Re: Snort Rules Neil Dickey (Jun 08)
RE: Where to configure/change rules for this one? Neil Dickey (May 03)
Re: Intro to Snort Neil Dickey (May 01)
Re: resp 2? Neil Dickey (May 16)
Re: is there anyway of stoping this? Neil Dickey (May 31)
Re: how to ignore scans from trusted hosts? Neil Dickey (May 31)
Re: ignoring udp scans Neil Dickey (May 04)
Re: resp? Neil Dickey (May 15)
Re: Where to configure/change rules for this one? Neil Dickey (May 03)
Re: Snort dumps core on Solaris 8 Neil Dickey (Jun 07)

NeoZ root () damnland org

apps to kill connection ? NeoZ root () damnland org (May 16)

niko

spp niko (Jun 30)
spp_portscan niko (Jun 22)

Ofir Arkin

RE: ISD171/ping zeros - One legit use Ofir Arkin (Jun 01)
RE: ICMP false possitives... Ofir Arkin (Jun 13)
RE: {off-topic} Who goes 2 Defcon9 Ofir Arkin (Jun 02)
RE: snort attacks Ofir Arkin (May 29)
Re: A new type of ICMP packet Ofir Arkin (May 25)
RE: ISD171/ping zeros - One legit use Ofir Arkin (May 31)
RE: DoD plugin? Ofir Arkin (May 02)
Where is my ICMP ID and ICMP Seq with ICMP Timestamp, AddressMask, Info output? Ofir Arkin (May 16)
RE: Smurf Amplification Attack Ofir Arkin (May 29)
RE: ICMP Unreachable IP short header Ofir Arkin (Jun 11)
Research Paper - ICMP Usage In Scanning v3.0 - RELEASED Ofir Arkin (Jun 03)
RE: Research Paper - ICMP Usage In Scanning v3.0 - RELEASED Ofir Arkin (Jun 03)

Olaf Gellert

IIS Unicode Attack-Code Olaf Gellert (Jun 01)

Olav Langeland

IP needed Olav Langeland (May 16)

Olivier Grumelard

Re: Alert on more than 1 rule? Olivier Grumelard (Jun 25)

ORA

Re: Snort-users digest, Vol 1 #753 - 13 msgs ORA (Jun 25)

Oxenreider, Jeff

RE: First time in NIDS mode, and... Oxenreider, Jeff (May 16)

Patrick Mullen

Call for features requests for SPPv2 Patrick Mullen (May 15)

patrick.n.fitzgerald.1

SnortDB schema vs. Snort XML schema. patrick.n.fitzgerald.1 (Jun 11)
Incorrect content-type header in XML output module? patrick.n.fitzgerald.1 (May 29)
RE: Centralized DB Server?? patrick.n.fitzgerald.1 (Jun 12)

Patrick Smallwood

Different Rel DB for snort? Patrick Smallwood (Jun 25)

Paul Asadoorian

INVALIDACK Paul Asadoorian (May 21)
HP Jetdirect Printers and portscans Paul Asadoorian (Jun 29)

Paul D. Shaffer

Snort and Firewall on the same box Paul D. Shaffer (May 11)

Paulie

ACID and snort 1.8? Paulie (Jun 13)
Re: chameleon overflow Paulie (Jun 08)
Re: I'm being attacked, now what? Paulie (Jun 15)
RE: Centralized DB Server?? Paulie (Jun 12)
ICMP false possitives... Paulie (Jun 12)

Paul Murphy

RE: Assign NO ip addr to interface Paul Murphy (Jun 14)
[Snort-users] Paul Murphy (Jun 11)
Re: FTP seen as portscan? Paul Murphy (Jun 27)
Re: [Snort-users] Speedera Paul Murphy (Jun 12)

pc2

binary log? pc2 (May 25)

per.thorsheim

unsubscribe per.thorsheim (May 13)

Pete Philips

http_decode alerts bypassing "pass" rules Pete Philips (May 09)

Peter Bates

Re: Assign NO ip addr to interface Peter Bates (Jun 14)
OT: Traffic monitoring? Peter Bates (May 16)
XML output plugin... Peter Bates (Jun 27)

Peter Zinck Wulff

Windows2000 Load balancing requests detected as IIS Unicode attack Peter Zinck Wulff (Jun 20)

Phil Wood

NOACK ****PR** Phil Wood (Jun 19)
Re: snort 1.8 rules Phil Wood (May 24)
Re: Tcpdump, alerts and portscans Phil Wood (Jun 25)
Version 1.8-beta6 (Build 26) Phil Wood (Jun 20)
Re: spp_tcp_stream2.c, "Not enough memory" Phil Wood (Jun 09)
spp_tcp_stream2.c, "Not enough memory" Phil Wood (Jun 08)
Re: Vision rules EXTERNAL/EXTERNAL_NET Phil Wood (May 16)
Re: ICMP Redirect Attack Phil Wood (May 09)
Re: Can I stop these port 53 detects? Phil Wood (Jun 21)
Re: Logging Question Phil Wood (Jun 11)
hog-vim, a vim syntax file for snort rule/configuration files Phil Wood (May 02)
Re: ARP mangling: Phil Wood (May 22)
Fiber's theoretical limit calculated at 100 terabits per strand of fiber Phil Wood (Jun 29)
Re: Rule IP addr (!192.168.1.1) didn't x-late, WTF? Phil Wood (Jun 27)
Re: Fw: Whitehats rules don't work Phil Wood (Jun 05)
Re: Bad port number error?? Phil Wood (Jun 14)
Re: BPF size on OpenBSD and multiple NICs Phil Wood (Jun 09)
Re: Tcpdump, alerts and portscans Phil Wood (Jun 25)
Re: ICMP Unreachable IP short header Phil Wood (Jun 11)
A new type of ICMP packet Phil Wood (May 25)
Re: Snort dumps core on Solaris 8 Phil Wood (Jun 07)
FatalError( ... ) in preprocessors Phil Wood (May 21)
Re: Can I stop these port 53 detects? Phil Wood (Jun 21)
Re: ICMP Echo Replies & Unknowns? Phil Wood (Jun 28)
Re: Stream4 and other stuff Phil Wood (Jun 29)
Re: FW: -o and pass/alert/log usage Phil Wood (Jun 27)
Re: binary log? Phil Wood (May 25)
Re: Possible DOS Attack?? Phil Wood (Jun 18)
Re: Snort dumps core on Solaris 8 Phil Wood (Jun 07)
New version of vim syntax file for snort configuration and rules files Phil Wood (May 23)
snort 1.8 rules Phil Wood (May 24)
Re: Garbled classification Phil Wood (Jun 05)
Re: Stream4 and other stuff Phil Wood (Jun 29)
Re: Re:A new type of ICMP packet Phil Wood (May 28)
Re: Wierd Packets, ICMP Dest Unreachable Phil Wood (Jun 14)
Re: how to ignore scans from trusted hosts? Phil Wood (Jun 01)

Piers Williams

RE: ignore host for just a couple of rules, not all Piers Williams (Jun 19)

Polar Bear

Re: sadmind rule Polar Bear (May 09)

Ralf Hildebrandt

Re: todays CVS checkout fails with a SEGFAULT Ralf Hildebrandt (May 10)
Re: >2Gb capture files Ralf Hildebrandt (Jun 26)
Re: Re: "Incomplete Fragments" logging wrong on HP-UX 10.20 Ralf Hildebrandt (May 23)
Re: Snort 1.7 dies on OpenBSD 2.9 after some time. Ralf Hildebrandt (Jun 21)
Re: How can I setup Snort to e-mail alerts? Ralf Hildebrandt (Jun 22)
Re: CVs is 1.7 or 1.8 Ralf Hildebrandt (Jun 20)
Re: ICMP Unreachable IP short header Ralf Hildebrandt (Jun 12)
Re: Snort 1.7 dies on OpenBSD 2.9 after some time. Ralf Hildebrandt (Jun 20)
Re: performance snort question Ralf Hildebrandt (Jun 19)
todays CVS checkout fails with a SEGFAULT Ralf Hildebrandt (May 10)
Re: >2Gb capture files Ralf Hildebrandt (Jun 25)
mon alert script for snort? Ralf Hildebrandt (May 04)
Memory leaks Ralf Hildebrandt (May 17)
Re: Too many ICMP Destination Unreachable (Port Unreachable) Ralf Hildebrandt (Jun 23)
Re: ICMP Unreachable IP short header Ralf Hildebrandt (Jun 11)
Re: Help Ralf Hildebrandt (May 23)
Re: Snort 1.7 dies on OpenBSD 2.9 after some time. Ralf Hildebrandt (Jun 20)
Garbled classification Ralf Hildebrandt (Jun 05)
Re: chameleon overflow Ralf Hildebrandt (Jun 08)
Re: help with "DNS SPOOF" incidents Ralf Hildebrandt (May 31)
Re: Intermittent syslog error Ralf Hildebrandt (Jun 26)
Re: ICMP Unreachable IP short header Ralf Hildebrandt (Jun 11)
Re: "Incomplete Fragments" logging wrong on HP-UX 10.20 Ralf Hildebrandt (May 17)
Re: Snort 1.8 beta5 Build 24 - Looks stable Ralf Hildebrandt (May 15)
Re: Merging new rules Ralf Hildebrandt (Jun 19)
ICMP Unreachable IP short header Ralf Hildebrandt (Jun 11)
Re: SIGHUP results in exit(1) Ralf Hildebrandt (May 27)

Ratta

inconvenientes Ratta (Jun 11)

Ray Seals

Oracle Database Table Explanation Ray Seals (May 29)
IP Addresses in Database tables Ray Seals (Jun 01)
RE: Oracle Database Table Explanation Ray Seals (Jun 01)
Why does /contrib/create_oralce have 2 CREATE TABLE EVENT entries? Ray Seals (Jun 01)
RE: Oracle Database Table Explanation Ray Seals (May 29)

rdanyliw

Re: ACID: Outer Join Not Supported rdanyliw (May 23)
Re: snort exiting oddly.. rdanyliw (Jun 19)
Re: [ACID] - trying to keep up rdanyliw (Jun 25)
RE: [snort-users] Re: ACID: Cannot send session cache limiter rdanyliw (May 24)

ricardo bravo

IPsec Tunnel ricardo bravo (May 24)
(no subject) ricardo bravo (May 24)

Rice, Bill (DeepGreen Bank)

RE: IDScenter - windows GUI front end for Windows S nort Rice, Bill (DeepGreen Bank) (May 03)

Rich Adamson

Re: Logging Question Rich Adamson (Jun 11)
ISD171/ping zeros - One legit use Rich Adamson (May 31)
Syslog problem??? Rich Adamson (May 27)
v1.7 syslog.c Win32 conversion error - Incorrect date parameters Rich Adamson (May 28)
Re: Re: HP Jetdirect Printers and portscans Rich Adamson (Jun 29)
RE: ISD171/ping zeros - One legit use Rich Adamson (Jun 01)
Re: Syslog trouble Rich Adamson (May 29)

Richard, Jeff

DNS Query Logging? Richard, Jeff (May 10)

Richard Oyh

Snort on a bridge Richard Oyh (May 29)

Rich Phelps

Testing Snort Rich Phelps (May 31)

Rich Smith

RE: DoD plugin Rich Smith (Apr 30)

Rich Wild

Error 43? Rich Wild (May 25)

Rimantas Mocevicius

Re: problem to run script from rc.local Rimantas Mocevicius (Jun 03)
problem to run script from rc.local Rimantas Mocevicius (Jun 03)
Re: netbios-name-query Rimantas Mocevicius (Jun 11)

Rino Mardo

SMBrelay signature anyone? Rino Mardo (Apr 29)
Re: Just FYI Rino Mardo (May 05)
Attention: List master - help please Rino Mardo (May 01)

Robert Bartman

Re: Snort dumps core on Solaris 8 Robert Bartman (Jun 05)

Robert D. Hughes

Core dumps on FBSD 4.3-stable Robert D. Hughes (Jun 06)
Can't chroot snort 1.8 beta6 build 26 Robert D. Hughes (Jun 20)
Feature question Robert D. Hughes (May 08)
RE: Arghh...how do I stop it doing this!! Robert D. Hughes (May 07)
RE: Seg faults, swap errors Robert D. Hughes (Jun 08)
RE: snort + aris Robert D. Hughes (May 12)

Robert L. Yelvington

netbios-name-query Robert L. Yelvington (Jun 08)

Robert van der Meulen

'FSM compilation failed' Robert van der Meulen (May 15)
[slightly OT] Re: hog-vim, a vim syntax file for snort rule/configuration files Robert van der Meulen (May 03)

Robinson, Ken

RE: Rules vs performance Robinson, Ken (May 11)
Rules vs performance Robinson, Ken (May 10)

robledo aloisio

core dumped robledo aloisio (May 30)

RoBSD

Snort behind host's firewall RoBSD (Jun 08)

roel

Re: spoof detection in snort roel (May 01)

Roeland Weve

ignore host for just a couple of rules, not all Roeland Weve (Jun 15)
performance snort question Roeland Weve (Jun 18)
simple quick question Roeland Weve (Jun 14)
Re: Article in June SysAdmin Roeland Weve (May 22)
logging output Roeland Weve (May 17)
deleting old entries in mysql Roeland Weve (Jun 01)
how to ignore scans from trusted hosts? Roeland Weve (May 31)
Re: performance snort question Roeland Weve (Jun 19)
snort_stat.pl Roeland Weve (Jun 14)
Re: Is there a complete PORT list online? Roeland Weve (Jun 06)
Re: performance snort question Roeland Weve (Jun 19)
swatch Roeland Weve (May 16)
Re: snort_stat.pl Roeland Weve (Jun 14)

rolinux

Snort in spatele unui firewall rolinux (Jun 08)

roman

Re: ACID inputting from alerts? roman (May 09)
Re: bcmath and ACID roman (Jun 25)
Re: acid 0.9.6b9 roman (Jun 24)
Re: acid + graphic alert area roman (May 22)
Re: ACID: Cannot send session cache limiter roman (May 23)
RE: Call for features requests for SPPv2 roman (May 16)
Re: ACID: more alerts than I asked for in acid_stat_uaddr... :) roman (Jun 20)
Re: inconsistency in acid-0.9.6b10? roman (May 22)
Re: [ACID] Call to undefined function: acidlong2ip() roman (May 17)
Re: ACID roman (May 04)
Re: loggin issue roman (May 10)
Re: Error in Acid roman (May 06)
RE: Re: ACID: Cannot send session cache limiter roman (May 23)
Re: snort 1.7+mysql+acid == headaches. pass the aspirin? (long) roman (May 11)
Re: Incorrect content-type header in XML output module? roman (Jun 01)
RE: {off-topic} Who goes 2 Defcon9 roman (Jun 04)
Re: Email using mysql roman (May 07)
Re: Problem with Acid 0.9.6b11 (from CVS): criteria propagation roman (Jun 26)
RE: Re: ACID: Cannot send session cache limiter roman (May 24)
Re: Snort + Acid w/ MySQL question(s) roman (May 10)
Re: Rule Managment Tool roman (May 10)
Re: UPDATE:: Compilation errors with mySQL roman (Jun 14)
Re: ACID + spp_portscan roman (May 24)
Re: loggin issue roman (May 10)
Re: Memory leaks roman (May 17)
Re: [ACID] error in create_acid_tbls_pgsql.sql roman (Jun 17)
Re: CVS changes in ACID roman (May 04)
Re: Snort + Acid w/ MySQL question(s) roman (May 11)
Re: [snort-users] ACID Error -- no snort.signature table roman (May 08)
Re: snort + mysql + acid + adodb roman (Jun 13)
Re: inconsistency in acid-0.9.6b10? roman (May 24)
Re: snort pgsql keepalive roman (May 10)
Re: Mysql table creation roman (Jun 13)
Re: ACID: more alerts than I asked for in acid_stat_uaddr... :) roman (Jun 25)
RE: Error in acid-0.9.6b9 roman (May 13)
Re: Undefined offset: 12 in c:\inetpub\wwwroot\acid\acid_db.inc on line 173 roman (May 29)
Re: inconsistency in acid-0.9.6b10? roman (May 24)
Re: Bug with timestamp. Snort 1.8 and FreeBSD and ACID roman (Jun 19)
Re: Oracle Database Table Explanation roman (May 29)
RE: Oracle Database Table Explanation roman (Jun 01)
Re: Snort + Acid w/ MySQL question(s) roman (May 11)
RE: FW: [ACID Newcomer] snort.signature table not a roman (May 25)
Re: Snort database schema depends on snort's version? roman (Jun 10)
Re: RE:Acid roman (May 07)
Re: deleting old entries in mysql roman (Jun 01)
Re: ACID: whois (ip-cache?) support and DB permissions roman (Jun 09)
Re: IP Addresses in Database tables roman (Jun 01)
Re: ACID and postgres: 7.1+ ??? roman (Jun 12)
Re: Snort + Acid w/ MySQL question(s) roman (May 10)
Re: mem leak and dead snort on Sun roman (May 15)
Re: Why does /contrib/create_oralce have 2 CREATE TABLE EVENT entries? roman (Jun 01)
Re: ACID and snort 1.8? roman (Jun 13)
Re: [ACID] errors on win32 install roman (May 22)
Re: Snort + Acid w/ MySQL question(s) roman (May 11)
Re: Snort + Acid w/ MySQL question(s) roman (May 13)
Re: ACID: more alerts than I asked for in acid_stat_uaddr... :) roman (Jun 25)
Re: is there anyway of stoping this? roman (May 31)
Re: spo_database oddity roman (May 04)
Re: Archiving support in Acid 0.9.6b10 roman (Jun 21)
Re: Snort + Acid w/ MySQL question(s) roman (May 11)
Re: Watching MAC addresses instead of IP's roman (May 19)
Re: Acid and Links to the Whitehats (etc) Alert Info. roman (Jun 25)
Re: Disabling DNS lookups in ACID? roman (May 06)
Re: Snort 1.7 and Acid 0.9.6b9 and MySQL 3.23.32 roman (May 16)
Re: Snort + Acid w/ MySQL question(s) roman (May 11)

Ronny Huybrechts

Fw: [ronny () vanroey be: lhr.skitter.caida.org] Ronny Huybrechts (Jun 09)

Ron Rosson

Re: snort + aris Ron Rosson (May 13)

Ron Taxer

snort on Win2k Ron Taxer (May 22)

Ron 'The InSaNe One' Rosson

Re: snort + aris Ron 'The InSaNe One' Rosson (May 15)
Re: snort + aris Ron 'The InSaNe One' Rosson (May 12)
snort + aris Ron 'The InSaNe One' Rosson (May 11)
[OT] Aris beta 1.01 Ron 'The InSaNe One' Rosson (May 09)

rottz

Re: [Snort-devel] When will snort be offically released? rottz (May 01)

R P G

help with "DNS SPOOF" incidents R P G (May 30)

Russ Johnson

Re: Can snort co-exist on same system along with NTOP? Russ Johnson (Jun 19)

Ryan McClure (Systems Admin) - United Shipping

unsubscribe Ryan McClure (Systems Admin) - United Shipping (May 11)
unsubscribe Ryan McClure (Systems Admin) - United Shipping (May 10)
******unsubscribe****** Ryan McClure (Systems Admin) - United Shipping (May 10)
unsubscribe Ryan McClure (Systems Admin) - United Shipping (May 11)
subsidy Ryan McClure (Systems Admin) - United Shipping (May 10)
unsubscribe Ryan McClure (Systems Admin) - United Shipping (May 11)
unsubscribe Ryan McClure (Systems Admin) - United Shipping (May 11)

Ryan Russell

Re: Does ICMP detection work or what? Ryan Russell (Jun 28)
Re: Re: HP Jetdirect Printers and portscans Ryan Russell (Jun 29)
Re: snort attacks Ryan Russell (May 29)
Re: Whad'ya do? Ryan Russell (May 08)
Re: snort + aris Ryan Russell (May 11)
Re: is there anyway of stoping this? Ryan Russell (May 31)
RE: I'm being attacked, now what? Ryan Russell (Jun 18)
Re: When is a hub not a hub? (AuthReply) Ryan Russell (Jun 05)
Re: Hub not a hub Ryan Russell (Jun 05)
RE: RE: Read-Only Ethernet cable Ryan Russell (Jun 21)

sales

רҵ·­Òë Polyglot Translation sales (Jun 17)

Salim Douba

Cheking content for all zeros Salim Douba (Jun 21)

Samir

Snort+Guardian Samir (Jun 14)
Newbie in Snort Samir (Jun 16)

Saragoth nntk

syslog Saragoth nntk (May 10)
RE: log Saragoth nntk (May 16)
log Saragoth nntk (May 15)

Sascha Ziemann

Snort and Ethereal Sascha Ziemann (May 05)

Scott A. McIntyre

BIND signature triggered. Scott A. McIntyre (Apr 29)
Version 1.8-beta5 (Build 24) Scott A. McIntyre (May 18)
Command line Acid. Scott A. McIntyre (May 16)
Re: BIND signature triggered. Scott A. McIntyre (Apr 30)
ACID inputting from alerts? Scott A. McIntyre (May 09)
Re: snort_stat.pl Scott A. McIntyre (Jun 14)
Re: ACID inputting from alerts? Scott A. McIntyre (May 09)
Quietly reading binary files. Scott A. McIntyre (May 11)

scott hutinger

-c switch scott hutinger (May 16)

Scott, Joshua

RE: First time in NIDS mode, and... Scott, Joshua (May 16)
RE: AOL Instant Messenger signature? Scott, Joshua (May 01)
Alerting on Snort Signatures Scott, Joshua (May 15)

Searle, Robert (XRCC)

3rd Party Snort Stuff Searle, Robert (XRCC) (May 01)

SecLists

snort, mysql configs SecLists (Jun 13)

securgrl

Re: Snort-users digest, Vol 1 #659 - 15 msgs securgrl (May 18)

Security

Re: snort behind firewall ?? Security (May 01)

sevald . lund

Port 10008?? sevald . lund (Jun 05)

Shane Machon

Logsnorter and Postgres Shane Machon (Jun 26)

shawn . moyer

Re: ******unsubscribe****** shawn . moyer (May 10)
Re: snort and aix shawn . moyer (May 07)
Disabling DNS lookups in ACID? shawn . moyer (May 04)
Re: DoD plugin? shawn . moyer (Apr 30)
Re: unsubscribe (Curbside Service) shawn . moyer (May 11)
Re: simple pass rules shawn . moyer (May 07)
Re: Rule Managment Tool shawn . moyer (May 10)
Re: Remote location shawn . moyer (May 15)

Sheahan, Paul (PCLN-NW)

Promiscious mode required? Sheahan, Paul (PCLN-NW) (Jun 13)
Does ICMP detection work or what? Sheahan, Paul (PCLN-NW) (Jun 28)
alert never triggers Sheahan, Paul (PCLN-NW) (Jun 26)
How to review actual packets? Sheahan, Paul (PCLN-NW) (Jun 11)
RE: I'm being attacked, now what? Sheahan, Paul (PCLN-NW) (Jun 15)
enter/exit promisc mode occasionally? Sheahan, Paul (PCLN-NW) (Jun 14)
ICMP Echo Replies & Unknowns? Sheahan, Paul (PCLN-NW) (Jun 27)
RE: Assign NO ip addr to interface Sheahan, Paul (PCLN-NW) (Jun 14)
Content "c:" Sheahan, Paul (PCLN-NW) (Jun 19)
Merging new rules Sheahan, Paul (PCLN-NW) (Jun 18)
RE: I'm being attacked, now what? Sheahan, Paul (PCLN-NW) (Jun 15)
Pass rule help Sheahan, Paul (PCLN-NW) (Jun 20)
-N switch fails? Sheahan, Paul (PCLN-NW) (Jun 14)
getcontact utility Sheahan, Paul (PCLN-NW) (Jun 17)
Disable all rules for a platform? Sheahan, Paul (PCLN-NW) (Jun 27)
RE: -o and pass/alert/log usage Sheahan, Paul (PCLN-NW) (Jun 27)
RE: -N switch fails? Sheahan, Paul (PCLN-NW) (Jun 14)
RE: Newbie Questions Sheahan, Paul (PCLN-NW) (Jun 18)
Snort hardware issues Sheahan, Paul (PCLN-NW) (Jun 13)
Whisker Head? Sheahan, Paul (PCLN-NW) (Jun 21)
Trouble with home-made rule Sheahan, Paul (PCLN-NW) (Jun 17)
Alert on more than 1 rule? Sheahan, Paul (PCLN-NW) (Jun 25)
I'm being attacked, now what? Sheahan, Paul (PCLN-NW) (Jun 15)
RE: -N switch fails? Sheahan, Paul (PCLN-NW) (Jun 14)
RE: Content "c:" Sheahan, Paul (PCLN-NW) (Jun 19)
RE: How can I setup Snort to e-mail alerts? Sheahan, Paul (PCLN-NW) (Jun 22)
commenting out rules? Sheahan, Paul (PCLN-NW) (Jun 16)
Stop creating address directories? Sheahan, Paul (PCLN-NW) (Jun 12)

Sid

Re: no of course not (was Re: Is whitehats.com/arachnids gone?) Sid (Jun 13)
Re: Memory leak Sid (May 03)
dos-large-icmp - FYI Sid (May 09)
Snort 1.8 Beta5 Build 24 - Leak Sid (May 15)
Fw: Whitehats rules don't work Sid (Jun 04)
Re: What does "VNC active on network" mean Sid (May 09)
Re: ACID and snort 1.8? Sid (Jun 14)
Docs for snort-1.8 Sid (May 13)
Re: ignoring udp scans Sid (May 04)
Capturing "successful-*" alerts Sid (Jun 13)
Re: Memory leak Sid (May 03)
ACID 0.9.6b9 problem Sid (May 14)
Snort/ACID setup Sid (May 15)
Whitehats rules don't work Sid (Jun 04)
Re: ISD171/ping zeros - One legit use Sid (May 31)
create_mysql for whitehats classification config Sid (Jun 11)
Re: Memory leak Sid (May 04)
Snort reporting and alerting Sid (May 27)
Re: Snort reporting and alerting Sid (May 28)
Hack attempts? Sid (Jun 11)
Re: snort + mysql + acid + adodb Sid (Jun 13)
ignoring udp scans Sid (May 03)
Re: Memory leak Sid (May 03)
Capturing "successful" attacks Sid (Jun 17)
Snort 1.8 beta5 Build 24 - Looks stable Sid (May 14)

Siddhartha Jain

Turning off portscans Siddhartha Jain (Apr 30)
Memory leak Siddhartha Jain (May 02)

Simon Frohn

end of portscan Simon Frohn (May 08)

skeller1

script to feed snort log directory data into acid skeller1 (May 21)

Skip Frizzell

(no subject) Skip Frizzell (May 04)

skop d'skop

Re: BPF size on OpenBSD and multiple NICs skop d'skop (Jun 10)
Re: Newbie question. skop d'skop (Jun 13)
syn/fin and src port skop d'skop (Jun 06)
Re: rpc.statd skop d'skop (Jun 06)
rpc.statd skop d'skop (Jun 05)

sonya sonya

Problem using snort sonya sonya (May 20)

Stacey Conrad

RE: Port 10008/tcp ? Stacey Conrad (May 15)

Stefan Dens

RE: ACID 0.9.6b9 problem Stefan Dens (May 14)
RE: Snort Install Doc Stefan Dens (Jun 27)

Stephen C Burns

FTP seen as portscan? Stephen C Burns (Jun 27)
RE: FTP seen as portscan? Stephen C Burns (Jun 27)

Steve

High CPU Steve (May 10)
Some assistance with Snort? steve (May 27)
Some assistance with Snort? steve (May 27)
snort help steve (May 27)

Steve Frank

RE: DNS Query Logging? Steve Frank (May 10)

Steve Halligan

RE: What does lightweight mean? Steve Halligan (May 30)
RE: IP needed Steve Halligan (May 16)
RE: Turning off portscans Steve Halligan (Apr 30)
RE: Does ECN trigger alarms? Steve Halligan (May 22)
RE: Portscan Preprocessor... Steve Halligan (May 09)
RE: SadMind rule Steve Halligan (May 09)
RE: Possible DOS Attack?? Steve Halligan (Jun 19)
RE: Email using mysql Steve Halligan (May 07)
RE: Email using mysql Steve Halligan (May 07)
RE: mem leak and dead snort on Sun Steve Halligan (May 15)
RE: IDS254 False positive? Steve Halligan (May 22)
spo_database oddity Steve Halligan (May 03)

Steve Hutchins

Snorts competition falling like flies Steve Hutchins (May 20)
RE: Patch for stick Steve Hutchins (May 08)

Steve Moran

snort attacks Steve Moran (May 29)
RE: snort attacks Steve Moran (May 29)
snort crash on w2k Steve Moran (Jun 05)

Steve Shockley

RE: Slightly OT - Re: My apologies Steve Shockley (May 11)
Boneheaded CVS update question Steve Shockley (May 15)
RE: Snort 1.8-beta4 Build 17 coredump Steve Shockley (May 11)
RE: Boneheaded CVS update question Steve Shockley (May 15)
RE: Snort 1.8-beta4 Build 17 coredump Steve Shockley (May 11)
RE: Boneheaded CVS update question Steve Shockley (May 15)
RE: Snort 1.8 beta5 Build 24 - Looks stable Steve Shockley (May 15)
Problem compiling source from cvs Steve Shockley (Jun 13)
RE: Snort 1.8-beta4 Build 17 coredump Steve Shockley (May 11)
RE: Snort and Firewall on the same box Steve Shockley (May 11)
(no subject) Steve Shockley (Jun 11)
Re: Re: HP Jetdirect Printers and portscans Steve Shockley (Jun 29)
Snort 1.8-beta4 Build 17 coredump Steve Shockley (May 10)

STP

please unsubscribe me STP (Jun 08)

Subba Rao

Name resolution Subba Rao (May 17)
Re: Alert messages and rule identification Subba Rao (May 17)
Logging Subba Rao (May 19)
Re: Portscan from own interface Subba Rao (May 16)
Re: Portscan from own interface Subba Rao (May 16)
Alert messages and rule identification Subba Rao (May 17)
Should I assume it has been safe? Subba Rao (May 15)
BPF size on OpenBSD and multiple NICs Subba Rao (Jun 09)
Re: Ramen worm and Snort log entry Subba Rao (Jun 17)
Ramen worm and Snort log entry Subba Rao (Jun 17)

Suchun . Wu

Snort log Suchun . Wu (May 01)
Patch for stick Suchun . Wu (May 07)

Sven Olensky

FW: snort & logging Sven Olensky (Jun 13)
RE: FW: snort & logging Sven Olensky (Jun 13)
RE: snort & logging Sven Olensky (Jun 11)
snort & logging Sven Olensky (Jun 11)

Sweth Chandramouli

Which options determine which packets are matched? Sweth Chandramouli (Jun 20)
Re: Which options determine which packets are matched? Sweth Chandramouli (Jun 20)

Talisker

Re: What does lightweight mean? Talisker (May 31)

Tan Chee Leong

Range values for TTL Tan Chee Leong (May 06)
Re: Range values for TTL Tan Chee Leong (May 07)

Tech-X

DoD plugin Tech-X (Apr 30)
Re: snort behind firewall ?? (./) Tech-X (Apr 29)

Terry Rankin

RE: ARP mangling: Terry Rankin (May 22)
ARP mangling: Terry Rankin (May 22)

Terry Schmidt

Reversing Snort Terry Schmidt (Jun 11)

thegonz

Undefined offset: 12 in c:\inetpub\wwwroot\acid\acid_db.inc on line 173 thegonz (May 29)

Thomas F.

Sub Thomas F. (Jun 11)

Thomas Linden

Re: SIGHUP results in exit(1) Thomas Linden (May 30)
SIGHUP results in exit(1) Thomas Linden (May 26)
config parser feature/failure? Thomas Linden (May 26)
Re: SIGHUP results in exit(1) Thomas Linden (May 26)
output to directory Thomas Linden (May 26)

Thomas Nilsen

Read-Only Ethernet cable Thomas Nilsen (Jun 19)
RE: Assign NO ip addr to interface Thomas Nilsen (Jun 14)
RE: Assign NO ip addr to interface Thomas Nilsen (Jun 14)
RE: RE: Read-Only Ethernet cable Thomas Nilsen (Jun 21)
Assign NO ip addr to interface Thomas Nilsen (Jun 14)
RE: Stream4 and other stuff Thomas Nilsen (Jun 29)

Thomas Whipp

RE: Whisker Head? Thomas Whipp (Jun 22)
Logging and database imports Thomas Whipp (May 03)
RE: Re[2]: performance snort question Thomas Whipp (Jun 19)
RE: Help with Adapter Thomas Whipp (May 18)
ACID + spp_portscan Thomas Whipp (May 24)
RE: Snort dumps core on Solaris 8 Thomas Whipp (Jun 05)
RE: Compile under Linux kernel 2.4.3 Thomas Whipp (Jun 15)
RE: is it possible Thomas Whipp (May 15)

Thorin

Re: Recall: Error trying to read in tcpdump file Thorin (Jun 12)

tim . gray1

alarm levels assigned to Snort rules tim . gray1 (Jun 26)

Tim Parker

Newbie Questions Tim Parker (Jun 18)
RE: Newbie Questions Tim Parker (Jun 18)

Tim Walraven

Automating Sunscreen Lite with Snort Tim Walraven (May 20)

Todd Ransom

Re: UDP is all I see.. Todd Ransom (May 16)
bogus savefile header Todd Ransom (Jun 20)

Togan Muftuoglu

DNS TO 137 Togan Muftuoglu (May 18)
Re: Aris Beta 1.01 Togan Muftuoglu (May 10)
Re: Shellcode x86 setgid 0 Togan Muftuoglu (May 13)
Shellcode x86 setgid 0 Togan Muftuoglu (May 13)
bind attack or what ? Togan Muftuoglu (Apr 30)

Tolpanov, Dmitry

RE: Ignore some ip's Tolpanov, Dmitry (Jun 27)
Problems. Tolpanov, Dmitry (Jun 25)
RE: Problems. Tolpanov, Dmitry (Jun 25)

Tom Kyle

Re: Snort dumps core on Solaris 8 Tom Kyle (Jun 06)
Re: Snort dumps core on Solaris 8 Tom Kyle (Jun 07)
Re: Snort dumps core on Solaris 8 Tom Kyle (Jun 07)
Snort dumps core on Solaris 8 Tom Kyle (Jun 04)

Tom Sevy

RE: Getting One instance of snort to sniff 2 interf aces Tom Sevy (May 03)
Can snort co-exist on same system along with NTOP? Tom Sevy (Jun 19)

Tony Lill

Re: how to ignore scans from trusted hosts? Tony Lill (Jun 01)
Re: how to ignore scans from trusted hosts? Tony Lill (Jun 01)
Re: -o and pass/alert/log usage Tony Lill (Jun 28)

Tremaine Lea

snort + mysql + acid + adodb Tremaine Lea (Jun 13)
snort 1.8 beta6 build26 Tremaine Lea (Jun 23)
snort exiting oddly.. Tremaine Lea (Jun 19)
Re: snort + mysql + acid + adodb Tremaine Lea (Jun 14)
Re: I'm being attacked, now what? Tremaine Lea (Jun 15)
Fwd: Re: How can I setup Snort to e-mail alerts? Tremaine Lea (Jun 22)

Treu, Jill

Password DoS Treu, Jill (Jun 18)
Problem getting snort to run w/ rule set Treu, Jill (Jun 20)

Tudor Panaitescu

Port 10008/tcp ? Tudor Panaitescu (May 15)
RE: Port 10008/tcp ? Tudor Panaitescu (May 15)
RE: Port 10008/tcp ? Tudor Panaitescu (May 15)

van Oosterom, Peter

RE: snort with mysql van Oosterom, Peter (May 02)
RE: Help with Adapter van Oosterom, Peter (May 18)

Victor Barahona

Archiving support in Acid 0.9.6b10 Victor Barahona (Jun 20)

Vitaly McLain

Re: [Snort-users] Horst Raditschnigg/Dueren/ISOLA ist außer Haus. Vitaly McLain (May 23)
Re: OT: "Pretty Packet Printer" Vitaly McLain (May 07)

Vitaly Osipov

Re: How can I filter... Vitaly Osipov (Jun 22)
Snort logging to Oracle Vitaly Osipov (May 24)
Re: Whisker Head? Vitaly Osipov (Jun 22)
Re: Newbie: Bot Detection Rule Vitaly Osipov (Jun 22)
Re: DNS, portscan, & laptops Vitaly Osipov (Jun 19)
Re: catch all rule Vitaly Osipov (Jun 19)
[Fwd: Limits to what ACID can handle?] Vitaly Osipov (Jun 11)

Vladimir Strezhnev

Snort/Postgresql: invalid timestamps on alpha and sparc with dormant Y2K Vladimir Strezhnev (Jun 28)

vogt

AW: >2Gb capture files vogt (Jun 25)
snort traffic vogt (Jun 21)

Wai-Kit Ho

How to install snort on Windows 2000? Wai-Kit Ho (Jun 20)
RE: How to install snort on Windows 2000? Wai-Kit Ho (Jun 20)

Watson, Ed

RE: snort.conf and rules Watson, Ed (May 15)
multiple rule sets Watson, Ed (May 14)
won't run initially Watson, Ed (May 09)
RE: Snort won't run Watson, Ed (May 10)
redundant rules Watson, Ed (May 10)
RE: swatch Watson, Ed (May 16)

william . c . gercken

Re: Testing Snort william . c . gercken (May 31)
Re: Snort dumps core on Solaris 8 william . c . gercken (Jun 07)
Re: Memory leak william . c . gercken (May 03)

William K. Hardeman

RE: Guardian William K. Hardeman (Jun 11)

William Pomian

[Newbie] pppoe William Pomian (Jun 07)
Re: [Newbie] pppoe William Pomian (Jun 07)

Williams Jon

snort on OS/390? Williams Jon (May 29)

World Internet Now! - Lists

[ACID] errors on win32 install World Internet Now! - Lists (May 21)
Win32 Application Error? World Internet Now! - Lists (May 23)
MAC Address Q... World Internet Now! - Lists (May 15)

Wozz

Re: Snort on a bridge Wozz (May 29)

Yen-Ming Chen

[Anno] snort_stat.pl 1.15.2.1 released (bugfix) Yen-Ming Chen (Jun 11)

Yom, Francis

Machine requirements Yom, Francis (Jun 22)
How can I setup Snort to e-mail alerts? Yom, Francis (Jun 21)

Zahid Khan

Re: snort 1.7 and Guardian.pl (IPCHAINS) Zahid Khan (Jun 12)

®}§ÓµØ

Is there a complete PORT list online? ®}§ÓµØ (Jun 06)
Previous period
Next period