Snort: by date

• RSS Feed
• About List
• All Lists

Previous period

Next period

3085 messages starting Jun 30 01 and ending Sep 30 01
Date index | Thread index | Author index

Saturday, 30 June

Re: Fwd: Re: Cisco HTTP Admin IOS attack signature Brian Caswell

Sunday, 01 July

Is snort missing something? steven
Is snort missing something? steven
what does this probe stand for ? Jose Miguel Varet
IPv4 Warnings Marcelo Gulin
What does this message mean? GeEk
Re: IPv4 Warnings Fyodor
Snort training! Mohsin Aziz
Re: Stream4 and other stuff Martin Roesch

Monday, 02 July

help-for problem-Win2K Advanced Server problems Raviraj Patil
Hybris worm (virus) and Snort Olafur Egilsson
Re: Stream4 and other stuff Victor Barahona
configuring snort daily report Dan Cuthbert
(no subject) Андрей Иванов
Defrag preprocessor crashing (was RE: Stream4 and o ther stuff) Mayers, Philip J
Re: configuring snort daily report Robert van der Meulen
Re: [Snort-devel] Defrag preprocessor crashing (was RE: [Snort-users] Stream4 and other stuff) Martin Roesch
Re: Defrag preprocessor crashing (was RE: [Snort-users] Stream4 and other stuff) Philip Mayers
Re: [Snort-devel] Defrag preprocessor crashing (was RE: [Snort-users] Stream4 and other stuff) Martin Roesch
Re: Defrag preprocessor crashing (was RE: [Snort-users] Stream4 and other stuff) Dragos Ruiu
Re: Defrag preprocessor crashing (was RE: [Snort-users] Stream4 and other stuff) Dragos Ruiu
Feature Request? Kevin Brown
Re: Feature Request? Dragos Ruiu
Re: Feature Request? Chris Green
RE: Feature Request? Kevin Brown
RE: Feature Request? Kevin Brown
spp_http_decode niko
Re: Newbie: Bot Detection Rule Bob Van Cleef
Re: Newbie: Bot Detection Rule Bob Van Cleef
Re: spp_http_decode Blake Frantz
using snort without an IP Addy Frontgate Lab
Re: Snort training! Virginia Beres
Re: Is snort missing something? Matt Watchinski
Re: using snort without an IP Addy Blake Frantz
Re: using snort without an IP Addy Dr SuSE
Re: using snort without an IP Addy Frontgate Lab
Re: using snort without an IP Addy Blake Frantz
Some broken rules in 1.8-beta7 Build 36 Phil Wood
Re: spp Joe McAlerney
Re: Some broken rules in 1.8-beta7 Build 36 Brian Caswell

Tuesday, 03 July

Re: Is snort missing something? Matt Scarborough
Re: spp_http_decode Vitaly Osipov
Re: Is snort missing something? steven
Real-time email notification Michael Pickert
crashing snort Williams Jon
Re: Real-time email notification A.L.Lambert
Re: using snort without an IP Addy Andy Bach
Re: Real-time email notification Tim Olson
Re: Real-time email notification Brian Carpio
nort behind ipchains 'blind'? Martijn Heemels
Re: Real-time email notification Blake Frantz
Re: Real-time email notification Blake Frantz
How to capture FTP session info? Mohamed LRHAZI
Promiscuos setting Subba Rao
Re: How to capture FTP session info? Ralf Hildebrandt
snortsnarf root
Re: How to capture FTP session info? Jim Forster
snort_stat Chris Eidem
Re: How to capture FTP session info? Blake Frantz
react Ramin Alidousti
Re: How to capture FTP session info? Mohamed LRHAZI
RE: nort behind ipchains 'blind'? Neal Timm
RE: snort behind ipchains 'blind'? Hawrylkiw, Dan G
spp_http_decode: CGI Null Byte attack detected nowhere
Version 1.8-beta8 (Build 33) Phil Wood
Re: Version 1.8-beta8 (Build 33) Martin Roesch
Newbie Alert: Missing Install Dependency Ryan Hill
RE: Newbie Alert: Missing Install Dependency Chris Owen
RE: Newbie Alert: Missing Install Dependency Neal Timm

Wednesday, 04 July

Re: nort behind ipchains 'blind'? Matthew Collins
Installing snort 1.8-beta build 37 in a chroot while logging to m ysql in RedHat 7.1 Chris Owen
RE: snort behind ipchains 'blind'? Martijn Heemels
Re: Re: Is snort missing something? steven
OT: Interesting trend Jason Lewis
Rule Actions's Name lenght problem Mohamed LRHAZI
DNS zone transfer? Marek Gutkowski
Re: nort behind ipchains 'blind'? John Sage
Re: snort behind ipchains 'blind'? John Sage
How do I log all traffic other than X and Y Mohamed LRHAZI
Re: How do I log all traffic other than X and Y GeEk
X-late problem Kari Suomela
Re: Re: Is snort missing something? Matt Scarborough

Thursday, 05 July

Re: DNS zone transfer? Kiira Triea
TEST pls ignore Piers Williams
snort-1.7-win32-static: only loging icmp packets Lee Leahu
[!] WARNING: Truncated ICMP-UNREACH header (9 bytes) Stephen C Burns
X-late problem Kari Suomela
Re: DNS zone transfer? Blake Frantz
basic use Stefano
Re: DNS zone transfer? Marek Gutkowski
Compile warning with gcc-3.0 in todays CVS checkout Ralf Hildebrandt
Re: Re: Is snort missing something? steven
RE: [!] WARNING: Truncated ICMP-UNREACH header (9 bytes) Stephen C Burns
Re: [!] WARNING: Truncated ICMP-UNREACH header (9 bytes) Fyodor
Re: X-late problem Dragos Ruiu
Re: snort-1.7-win32-static: only loging icmp packets Matt Scarborough
RE: Newbie Alert: Missing Install Dependency Ryan Hill
Only seeing arp traffic? Paul Asadoorian
RE: Newbie Alert: Missing Install Dependency Neal Timm
Re: Only seeing arp traffic? Thorin
Latest CVS - still invalid timestamps on Alpha Linux Vladimir Strezhnev

Friday, 06 July

Snort conf examples Stefano
[ hello] Raviraj Patil
RE: Snort conf examples Neal Timm
Call for Bugs Martin Roesch
RE: >2Gb capture files Shriman Gurung
[Snort-devel] Call for Bugs -> icmpscaner Serge Droz
off-topic: DEFCON pbsarnac
RE: Only seeing arp traffic? Hawrylkiw, Dan G
Re: Call for Bugs Ralf Hildebrandt
Re: off-topic: DEFCON Dr SuSE
Re: Call for Bugs Ralf Hildebrandt
Re: >2Gb capture files Chris Green
Re: >2Gb capture files Ryan Russell
RE: >2Gb capture files Clausing, James A (Jim), SOBUS
Re: >2Gb capture files Martin Roesch
RE: off-topic: DEFCON Yom, Francis
RE: off-topic: DEFCON Brian Carpio
Got NULL *froot in ReassembleIP(), please tell Dragos Phil Wood
Re:[ hello] Matt Scarborough
Bug Roundup--Chroot Broken? Erek Adams
Re: Bug Roundup--Chroot Broken? Chris Green
Emailing Alerts from ACID Claussen, Ken

Saturday, 07 July

Win32 Jac Engel
RE: >2Gb capture files Mayers, Philip J
RE: >2Gb capture files Shriman Gurung
Re: Bug Roundup--Chroot Broken? Erek Adams
OT: Tool to Decode shellcode? Erek Adams
react Ramin Alidousti
Re: react Martin Roesch
Re: react Dragos Ruiu
Re: OT: Tool to Decode shellcode? Dragos Ruiu
Re: react Ramin Alidousti

Sunday, 08 July

Beta 10/Build 38 avaialable Martin Roesch
Re: OT: Tool to Decode shellcode? Erek Adams
Re: OT: Tool to Decode shellcode? Fyodor
Re: OT: Tool to Decode shellcode? Steve Shockley
Connection lost Luca Mauri
--enable-smbalert typos Kurt Grutzmacher
RE: Beta 10/Build 38 available Jason Lewis
Re: Snort-users digest, Vol 1 #785 - 13 msgs ORA
Re: Connection lost Dragos Ruiu
Re: OT: Tool to Decode shellcode? Dragos Ruiu

Monday, 09 July

SISR & HFPM Juan Jose Ledesma Poveda
Misc - Zone Transfer Fale Positives Paul Asadoorian
Snort+database HOWTO??? Peter Bates
How to keep internal traffic out of "HTTP decode" Marcus Vinícius de Melo Rocha
Re: Misc - Zone Transfer Fale Positives Paul Asadoorian
RE: Snort+database HOWTO??? Peter Bates
Introducing HogWash Jed Haile
Database logging gerhard
Re: Connection lost Luca Mauri
RE: Database logging Kevin Brown
Re:[ hello] Matt Scarborough
Snorters @ Defcon Dr SuSE
Re: Snorters @ Defcon Martin Roesch
Re: Snort-users digest, Vol 1 #787 - 8 msgs ORA
promiscious mode..and stuff. Franki
RE: Snorters @ Defcon Ofir Arkin
Re: Connection lost Matt Scarborough
frag2(?) Core Dump: 1.8beta10-build40 Sash Biskut
(no subject) cboy
Snort 1.8 released Martin Roesch
Re: (no subject) Blake Frantz
Snort 1.8 release party on irc.linux.com Martin Roesch
Snort FAQ 1.8 Dragos Ruiu
Re: (no subject) Dragos Ruiu
new spp_defrag.c v1.4b Dragos Ruiu
ACID news roman
Re: [Snort-sigs] bad rule in ftp.rules? (1.8 cvs) HABU Takuya

Tuesday, 10 July

Re: new spp_defrag.c v1.4b Ralf Hildebrandt
RE: Snort 1.8 released Mayers, Philip J
spp_defrag.c v1.5 Dragos Ruiu
RE: spp_defrag.c v1.5 Thomas Whipp
snort 1.8-Release year switch Pär Thoren
Snort not working in a multi hub environment? Devdas Bhagat
RE: Snort not working in a multi hub environment? Thomas Whipp
RE: Snort not working in a multi hub environment? Devdas Bhagat
RE: Snort not working in a multi hub environment? Thomas Whipp
RE: Snort not working in a multi hub environment? Devdas Bhagat
Linking 1.8 in Solaris Paul Asadoorian
Re: Linking 1.8 in Solaris Bill Marquette
reg Mysql and ACID akshaye kalkura
Start up options Chris Eidem
ACID gerhard
spp_arpspoof core - solaris 2.6 (after adding -lresolv to LIBS var) Bill Marquette
Re: Start up options Chris Eidem
Re: ACID Marcelo Gulin
Hardware Requirements for Running SNORT on Windows 2000 Matt Joyce
Suscribe Ivan Hernandez
Sourcefire: Commercial Snort-based Sensor Appliances entering beta testing Martin Roesch
Re: Snort-users digest, Vol 1 #791 - 5 msgs ORA
On the road... Martin Roesch
Re: spp_arpspoof core - solaris 2.6 (after adding -lresolv to LIBS var) Fyodor
Re: Re: Snort-users digest, Vol 1 #791 - 5 msgs Fyodor
UNSUBSCRIBE... ORA
More spp_arpspoof crashing on solaris 2.6 Bill Marquette
Re: UNSUBSCRIBE... Ramin Alidousti
Re: More spp_arpspoof crashing on solaris 2.6 Fyodor
RE: error message with snort Kevin Brown
error message with snort Darrin Powell
Re: error message with snort Erek Adams
Re: error message with snort Ramin Alidousti
Re: Snort FAQ 1.8 Ramin Alidousti
Re: Snort FAQ 1.8 Blake Frantz
Re: Re: Snort-users digest, Vol 1 #791 - 5 msgs Dan Hollis
Re: Snort FAQ 1.8 Ramin Alidousti
spp_defrag.c v1.5.1 Dragos Ruiu
RE: Snort not working in a multi hub environment? dave . goldsmith
tcpdump && snort Daniel Voyer
Re: Snort FAQ 1.8 Phil Wood
Re: Snort FAQ 1.8 Ramin Alidousti
snort 1.8/solaris 8 Jeff Ito
RE: snort 1.8/solaris 8 Kevin Brown
RE: Snort FAQ 1.8 Kohlenberg, Toby
Re: Snort FAQ 1.8 Dragos Ruiu
Re: Snort FAQ 1.8 Phil Wood
Snortin @ Defcon9.....the final plan Dr SuSE
activate/dynamic bug with ruletypes.. Erik Fichtner
Re: snort 1.8/solaris 8 Fyodor
Re: snort 1.8/solaris 8 Michael H. Warfield
kill -USR1 bogon Doug White
(no subject) John Johnson
Request network config check... Markt
RE: Snort not working in a multi hub environment? Devdas Bhagat

Wednesday, 11 July

Snort-users digest, Vol 1 #796 - 11 msgs snort-users
Snort-users digest, Vol 1 #795 - 7 msgs snort-users
Snort-users digest, Vol 1 #794 - 9 msgs snort-users
Autoreply: Snort-users digest, Vol 1 #798 - 1 msg essy
Autoreply: Snort-users digest, Vol 1 #797 - 7 msgs essy
Re: spp_defrag.c v1.5.1 Fran�ois D�sarm�nien
SnortSnarf-052301.1 margardi
Re: spp_defrag.c v1.5.1: SIGSEGV Fran�ois D�sarm�nien
spp_stream4: EVASIVE RST detection Ralf Hildebrandt
RE: (no subject) Bill Gercken
Snort-Machine = Security Hole? Thorsten Ziegler
UUnet dns server portscans filling up log.. causing email of real alerts to crash Madhav Diwan
Re: react Maciej Tomasz Szarpak
Re: Snort-Machine = Security Hole? Ramin Alidousti
Re: react Ramin Alidousti
Re: UUnet dns server portscans filling up log.. causing email of real alerts to crash Ramin Alidousti
Re: UUnet dns server portscans filling up log.. causing email of real alerts to crash Jeff Ito
Snort 1.8 Problems Lodin, Steven {GZ-Q~Mannheim}
Linuxberg.com should get a clue Dr SuSE
RE: UUnet dns server portscans filling up log.. causing email of real alerts to crash Madhav Diwan
RE: UUnet dns server portscans filling up log.. causing email of real alerts to crash Madhav Diwan
Re: (no subject) Phil Wood
Error with rules Jason Smith
RE: Error with rules Jason Smith
Re: UUnet dns server portscans filling up log.. causing email of real alerts to crash Ramin Alidousti
RE: UUnet dns server portscans filling up log.. causing email of real alerts to crash Jeff Ito
weird signatures........ David
Re: DNS zone transfer? James Hoagland
FW: [Snort-announce] Sourcefire: Commercial Snort-based Sensor Appliances entering beta testing Michael Steele
Re: SISR & HFPM James Hoagland
RE: Snort FAQ 1.8 Burleson, Lee (IA)
IDMEF XML Pluggin Jason Galarneau
Re: Snort FAQ 1.8 Ramin Alidousti
Re: Re: [Snort-users] spp_defrag.c v1.5.1: SIGSEGV Dragos Ruiu
Dr SuSE contact info Dr SuSE
Re: Snort FAQ 1.8 Phil Wood
reducing referrer false-positives Doug White
DEMARC 1.04 Released DEMARC Org.
chroot semantics fubar again in 1.8 Erik Fichtner
snort 1.8 John Johnson
Re: chroot semantics fubar again in 1.8 Erek Adams
Re: chroot semantics fubar again in 1.8 Dragos Ruiu
Enhanced SPEC-file for snort 1.8 Dag Wieers
Enhanced SPEC-file for snort 1.8 (WITH attachement) Dag Wieers
RE: snort 1.8 Bill Gercken
snort 1.8 Phil Wood
"inet_aton" error on Solaris 8 Michael McAuliffe
Re: "inet_aton" error on Solaris 8 Jeff Ito
RE: snort 1.8 John Johnson
Re: snort 1.8 Fyodor
Re: "inet_aton" error on Solaris 8 A.L.Lambert
Re: Snort-Machine = Security Hole? barre

Thursday, 12 July

How to use a list of ports but not a range? Kohlenberg, Toby
Re: How to use a list of ports but not a range? Dragos Ruiu
Snart with snort 1.8 Serge Droz
[completely offtopic] help needed... Fyodor
RE: Re: [Snort-users] spp_defrag.c v1.5.1: SIGSEGV Lodin, Steven {GZ-Q~Mannheim}
Is there some problem w/ 3Com cards? Kiira Triea
Re: Snort-Machine = Security Hole? Daniel Voyer
Re: snort 1.8 Scott Nursten
Re: snort 1.8 Fyodor
Re: snort 1.8 Scott Nursten
RE: Snort-Machine = Security Hole? Crow, Owen
Unicode stdout problem Michael Aylor
Snort 1.8p1 on Solaris 8 Paul Asadoorian
Re: Is there some problem w/ 3Com cards? Rich Adamson
snort+mysql+acid Marcus Henschel
Re: Snort 1.8p1 on Solaris 8 Bill Marquette
Re: Snort 1.8p1 on Solaris 8 Paul Asadoorian
Antwort: RE: Snort-Machine = Security Hole? ks
(no subject) Randall Paige
Re: Unicode stdout problem Fyodor
Re: snortsnarf James Hoagland
RE: Antwort: RE: Snort-Machine = Security Hole? Crow, Owen
Snort-Machine = Security Hole? Davis, Scott
Re: Antwort: RE: Snort-Machine = Security Hole? Daniel Voyer
Re: Antwort: RE: Snort-Machine = Security Hole? Ramin Alidousti
RE: Antwort: RE: Snort-Machine = Security Hole? Crow, Owen
RE: Snort-Machine = Security Hole? Burleson, Lee (IA)
1.8 Tarball and MD5 hashes Matt Joyce
Re: 1.8 Tarball and MD5 hashes Bill Marquette
FW: 1.8 Tarball and MD5 hashes Matt Joyce
RE: Snort-Machine = Security Hole? ks
Antwort: Re: Antwort: RE: Snort-Machine = Security Hole? ks
Re: Snort-Machine = Security Hole? Daniel Voyer
Re: Antwort: RE: Snort-Machine = Security Hole? Ramin Alidousti
RE: Antwort: RE: Snort-Machine = Security Hole? Steve Hutchins
RE: Antwort: RE: Snort-Machine = Security Hole? Frank Knobbe
Re: snort+mysql+acid Erek Adams
snort newbie question twig les
Re: Antwort: RE: Snort-Machine = Security Hole? Ramin Alidousti
Re: reg Mysql and ACID roman
Re: Snort-Machine = Security Hole? Dan Hollis
spec file Neal Timm
Snort 1.8 and Windows 2000 John Hall

Friday, 13 July

automated updater scripts for 1.8? Snort IDS
create_mysql Marcus Henschel
Re: snort newbie question Kiira Triea
Re: Is there some problem w/ 3Com cards? Kiira Triea
Re: spp_stream4: EVASIVE RST detection Ralf Hildebrandt
ACID Undefined variable Gisli Helgason
Snort1.8p1 core dump Patrick Fouquet
Re: Snort1.8p1 core dump Fyodor
Thanks (Re: [completely offtopic] help needed...) Fyodor
Re: create_mysql Ian Jones
Comprehensive how-to for installing Snort with MySql & Acid Tom Sevy
RE: Comprehensive how-to for installing Snort with MySql & Acid Losinski, Robert
RE: snort newbie question swilcoxon
RE: spec file Bill Gercken
RE: spp_stream4: EVASIVE RST detection Bill Gercken
Various problems in 1.8p1 Andreas Steinmetz
RE: Snort-Machine = Security Hole? Andreas Steinmetz
newbie question charles . t . funderburk
snort logging newbie question take 2 twig les
RE: spp_stream4: EVASIVE RST detection Steve Halligan
RE: Snort-Machine = Security Hole? Robert D. Hughes
RE: Snort-Machine = Security Hole? Dan Hollis
phantom portscans with stream4_reassemble Tony Lill
Has anyone used snort as engine for snmp agent i.e. an RMON probe Raymond Jacob

Saturday, 14 July

Error: Unknown config: classification Mark Bayne
Re: automated updater scripts for 1.8? Andreas Östling
RE: Error: Unknown config: classification Jeff Dell
"please tell Dragos" error from snort Jones, Benny
RES: spp_stream4: EVASIVE RST detection Marcus Vinícius de Melo Rocha
Re: "please tell Dragos" error from snort Ralf Hildebrandt
Re: "please tell Dragos" error from snort Fyodor

Sunday, 15 July

Gnutella based applications Phil Wood
Re: Is there some problem w/ 3Com cards? Jason A. Haynes
ANNOUNCE: snort-rep 1.0 David Schweikert
SuSE 7.1 and snort Dallam Wych

Monday, 16 July

L3retriever Stefano
Re: L3retriever John Sage
Portscan > database gerhard
acid errors Steve Moran
Not logging any alerts ?? Darrin Powell
snort_stat.pl andreas
RES: acid errors marcus
RE: acid errors Steve Moran
Re: ACID Undefined variable roman
Re: snort_stat.pl Erek Adams
Re: acid errors rdanyliw
Re: Portscan > database roman
re: Not logging any alerts ?? twig les
snort+dynamic ip address Marcus Henschel
Re: snort+dynamic ip address Dragos Ruiu
AW: snort+dynamic ip address Marcus Henschel
Snort 1.8 status, etc Martin Roesch
dns.rules... Snort Rule ID: 259 named overflow Dragos Ruiu

Tuesday, 17 July

faking database entries Yonah Russ
AW: AW: snort+dynamic ip address Marcus Henschel
DNS 53 <-> 53 ? Jens Hassler
Re: chroot semantics fubar again in 1.8 Jason Haar
Re: DNS 53 <-> 53 ? Ramin Alidousti
Re: dns.rules... Snort Rule ID: 259 named overflow Brian Caswell
RE: DNS 53 <-> 53 ? John Berkers
Re: DNS 53 <-> 53 ? Ramin Alidousti
SNORTNET Gary Barnden
Tcpdump binary log splitter? william . c . gercken
Make problem on Cobalt Qube2 Glen Scott
RE: DNS 53 <-> 53 ? Jens Hassler
False alarm due to wrong byteordering Ralf Hildebrandt
RE: DNS 53 <-> 53 ? Jens Hassler
Re: faking database entries roman
RES: DNS 53 <-> 53 ? Marcus Rocha
Re: DNS 53 <-> 53 ? Blake Frantz
Total Newbie Question Cuthbert, Lance (DeepGreen Bank)
RE: Snort-Machine = Security Hole? Hawrylkiw, Dan G
Re: DNS 53 <-> 53 ? Ramin Alidousti
RE: DNS 53 <-> 53 ? Graeme Fowler
RE: Total Newbie Question Neal Timm
Snort Newbie questions regarding Win2k vs Linux/Unix Mohsin Aziz
Re: DNS 53 <-> 53 ? Ramin Alidousti
Re: Tcpdump binary log splitter? Chris Green
Re: Make problem on Cobalt Qube2 Fyodor
Re: SNORTNET Fyodor
eth0 going in and out of promiscuous mode? Darrin Powell
!Multiple Ports Tim Olson
Re: eth0 going in and out of promiscuous mode? Ralf Hildebrandt
RE: eth0 going in and out of promiscuous mode? Jason Smith
Snort outside of firewall and no alerts??? Darrin Powell
RE: eth0 going in and out of promiscuous mode? Jeff Ito
RE: eth0 going in and out of promiscuous mode? Jason Smith
Problems starting snort, yet again. C. Bensend
RE: Problems starting snort, yet again. Bill Gercken
RE: Problems starting snort, yet again. C. Bensend
Re: [Snort-devel] Introducing HogWash tlewis
Re: !Multiple Ports Mohamed LRHAZI
change ip addresses to hostnames? Douglas F. Elznic
Re: change ip addresses to hostnames? Ian Jones
Re: Problems starting snort, yet again. Brett G. Lemoine
RE: Problems starting snort, yet again. Dragos Ruiu
RE: DNS 53 <-> 53 ? Jens Hassler
Re: [Snort-devel] Introducing HogWash Jed Haile

Wednesday, 18 July

Compile question ./configure --with-openssl=/usr/bin/openssl --with-mysql=$DBHOME Jorge Reyes
Re: [Snort-devel] Introducing HogWash Brian Caswell
Re: Compile question ./configure --with-openssl=/usr/bin/openssl --with-mysql=$DBHOME Daniel Voyer
core dumped Juliano Bento
Newbie needs/wants documentation Ronnie Clark
Re: [Snort-devel] Introducing HogWash tlewis
RE: Compile question ./configure --with-openssl=/usr/bin/openssl --with-mysql=$DBHOME Jorge Reyes
alerts? Dominick, David
RE: Newbie needs/wants documentation Dan Fiorito
Re: alerts? C. Bensend
Dump Robledo R. Aloisio
RE: Compile question ./configure --with-openssl=/usr/bin/openssl --with-mysql=$DBHOME roman
HTTP/CGI exploits Andrew Daviel
Re: Dump Jensenne Roculan
Re: alerts? Mordechai Ovits
Re: Dump Phil Wood
Re: Dump Jensenne Roculan
HTTP/CGI exploits Andrew Daviel
MySQL problems with Snort on Win2k Wuzzie Kingo
Newbie needed for testing Dr SuSE
Re: MySQL problems with Snort on Win2k George Lewis
RE: Newbie needs/wants documentation Joe Stevensen
Re: Dump Lai Zit Seng
Re: Dump Martin Roesch
port ranges/selection Jonathan J. Hart
Stream4 update checked in Martin Roesch
Re: Stream4 update checked in Lai Zit Seng
Re: Stream4 update checked in Lai Zit Seng
What speed? Lists

Thursday, 19 July

Arthus T. Lim/IT/AIM is out of the office. alim
Compiling errors on Solaris-2.5.1: libpcap - undefined symbol Auteria Wally Winzer Jr.
static build Holger . Woehle
Re: Stream4 update checked in Martin Roesch
Re: Stream4 update checked in Lai Zit Seng
Snort-users -- confirmation of subscription -- request 937951 Gelaude Gerald M
Re: Compiling errors on Solaris-2.5.1: libpcap - undefined symbol Fyodor
Re: port ranges/selection Jim Forster
Re: What speed? Phil Wood
#Snort IRC Channel Yom, Francis
Interpreting logs Migus, Adam
Re: #Snort IRC Channel Dr SuSE
Snort PID problem Sheahan, Paul (PCLN-NW)
Database schema gone awry? Mark Rowlands
1.8p1 core dump in daemon mode Patrick Hawley
Re: Stream4 update checked in Martin Roesch
a really stupid question GaRaGeD
RE: What speed? Mayers, Philip J
Snort 1.8p1, logging more information... how?? Steve Williams
Re: Database schema gone awry? roman
Re: Database schema gone awry? Mark Rowlands
Re: 1.8p1 core dump in daemon mode Patrick Hawley
Re: Compile question ./configure --with-openssl=/usr/bin/openssl --with-mysql=$DBHOME Guy Bruneau
ip_src & ip_dst janvrt
Build 46 checked in Martin Roesch
snort dumps core after 2 hours Andreas Maus
RE: Compile question ./configure --with-openssl=/usr/bin/openssl --with-mysql=$DBHOME Jorge Reyes
Feature Request Jason Robertson
help with packet trace Robert L. Yelvington
Re: help with packet trace Ryan Russell
Re: snort dumps core after 2 hours Martin Roesch
RE: help with packet trace Neal Timm
Re: ip_src & ip_dst roman
IIS buffer exploit Tremaine Lea
PPPoE when Snort not talking listening on PPP interface Wynn Fenwick
RE: snort dumps core after 2 hours Scott
snort disk: bsd or linux Holger . Woehle
Re: Interpreting logs Ralf Hildebrandt
Re: Stream4 update checked in Lai Zit Seng

Friday, 20 July

Re: ip_src & ip_dst Mark Rowlands
Snord it's not able to start RoBSD
mysql and alert log LaraCroft
Re: What speed? Ben Hughes
Whitehats Question John Berkers
RE: What speed? Mayers, Philip J
Snort-1.8.1-beta2 status? Martin Roesch
Output modules, using two prioritys with syslog ? Olafur Egilsson
Acid 0.9.6b6 Reference Links Brad T.
Re: Snord it's not able to start Phil Wood
portscan reported from virtual interfaces Jeffrey Meltzer
Snort-1.8.1-beta3 uploaded to CVS Martin Roesch
Experience with Snort on Alpha platform Francois Baligant
Help with CVS Tim Olson
Comments. Erek Adams
Snort-1.8.1-beta3 tarball available at snort.org Martin Roesch
Re: Help with CVS Fyodor
MISC loopback traffic Francois Baligant
RE: Help with CVS Tom Sevy
speedera network Jim Howard
Newbie question Jim Starke
Re: MISC loopback traffic Brian Caswell
RE: Bash: Snort: command not found Klimarchuk John
Re: Help with CVS Fyodor
RE: RE: Bash: Snort: command not found Graeme Fowler
Snort Db Problem Patrick . Prue
feedback anonpoet
Snort spec file Neal Timm
Re: Acid 0.9.6b6 Reference Links roman
Re: Acid 0.9.6b6 Reference Links Brad T.
Re: Snort FAQ 1.8 Paul Howell
Re: Snort Db Problem roman
Re: Acid 0.9.6b6 Reference Links rdanyliw
RE: Interpreting logs Migus, Adam
Re: Snort Db Problem Brian O. Culver
Re: Acid 0.9.6b6 Reference Links Brad T.
FW: CodeRed: the next generation Chris Schuler
Re: Snort FAQ 1.8 Dragos Ruiu
Re: FW: CodeRed: the next generation Ryan Russell
Re: MISC loopback traffic Phil Wood
Re: portscan reported from virtual interfaces Dragos Ruiu
demarc.org - anyone using it? Robert L. Yelvington
RE: Snort Db Problem Patrick . Prue
Re: Acid 0.9.6b6 Reference Links roman
Re: Acid 0.9.6b6 Reference Links Brad T.
Testing Snort sleen
Re: demarc.org - anyone using it? sleen
detecting code red Souza, Chris
RE: demarc.org - anyone using it? Dell, Jeffrey
Re: Testing Snort Dr SuSE
Re: detecting code red Ryan Russell
flexresp, OpenBSD 2.9, snort 1.8p1 and 1.8.1-beta3 Khristian Pauze
Re: demarc.org - anyone using it? Jim Forster
RE: Testing Snort Joe Stevensen
RE: demarc.org - anyone using it? Dell, Jeffrey
Re: Testing Snort Ben Johansen
Re: Testing Snort Dr SuSE
Portscan and SSL data encryption Guy Bruneau
Re: detecting code red Blake Frantz
Re: Testing Snort Andreas Östling
Re: Testing Snort Wynn Fenwick
Re: Portscan and SSL data encryption Jed Pickel
RE: demarc.org - anyone using it? Blake Frantz
TCP reassembly question cha test
Re: Testing Snort Craig Woods
Make error Jorge Reyes
RE: FW: CodeRed: the next generation Franki
RE:[Snort-users]; Compile question ./configure --with-openssl=/usr/bin/openssl --with-mysql=$DBHOME Jorge Reyes
RE: Make error Jorge Reyes
Newbie: Snort and external programs Lars Norman Søndergaard

Saturday, 21 July

FAQ 1.8 ICMP Corrections Ofir Arkin
Re: Newbie: Snort and external programs Dragos Ruiu
RE: Newbie: Snort and external programs Lars Norman Søndergaard
RES: detecting code red Marcus Rocha
Snort Version 1.8-RELEASE (Build 43) mls
Re: Make error Phil Wood
Re: demarc.org - anyone using it? .
smb alerts not working maillists
RE: demarc.org - anyone using it? Jeff Dell
Snort + iptables Bradley M Alexander
Re: Snort + iptables Ian Jones
Re: Snort + iptables Andreas Hasenack
Re: Snort + iptables Ian Jones
Distributed Snort.. Charles Hessifer

Sunday, 22 July

RE: Distributed Snort.. John Berkers
Re: Testing Snort Kiira Triea
stream4 alerts Tobias von Koch
Error message that has me completely stumped Mike Tavares
Memory leak Michel van Osenbruggen
Re: Error message that has me completely stumped Dr_Jung
RE: Error message that has me completely stumped Joe Lawson
Snort Report 1.0 Released David Gullett
snort and syslog Douglas F. Elznic
bpf filter? gatekeeper
Typo in snort faq regarding libpcap? Douglas F. Elznic
Re: smb alerts not working Tony Lill
RE: bpf filter? Jason Opperisano
Re: Snort-1.8.1-beta3 tarball available at snort.org Steve Williams

Monday, 23 July

Re: Typo in snort faq regarding libpcap? Dragos Ruiu
Re: demarc.org - anyone using it? Shane Machon
Snort - Compiling error on Solaris 2.6 Thong Choi Woon
RE: Newbie: Snort and external programs Dragos Ruiu
ignore a ip LaraCroft
Re: MISC loopback traffic Francois Baligant
Re: Snort - Compiling error on Solaris 2.6 bill . marquette
RE: snort and syslog Shriman Gurung
RE: Distributed Snort.. Oxenreider, Jeff
RE: Tcpdump binary log splitter? Shriman Gurung
Re: MISC loopback traffic Brian Caswell
Re: Snort-1.8.1-beta3 tarball available at snort.org Martin Roesch
Re: Snort + iptables SHAIFUL HASHIM
Re: Acid 0.9.6b6 Reference Links roman
Make error libmysqlclient.so: undefined reference to `mkstemp64@GLIBC_2.2' collect2: ld returned 1 exit status Jorge Reyes
snort-1.8.1-beta4 available Martin Roesch
Re: Typo in snort faq regarding libpcap? Martin Roesch
Re: Acid 0.9.6b6 Reference Links Brad T.
Snort is going down sometimes... Marcin Zurakowski
Snort is going down sometimes... one more thing Marcin Zurakowski
Re: Snort is going down sometimes... Ralf Hildebrandt
my snort ps keeps dying... Fred Edwards
Re: Acid 0.9.6b6 Reference Links Brad T.
Re: snort and syslog John Sage
Re: my snort ps keeps dying... Chris Green
Re: Snort is going down sometimes... Marcin Zurakowski
Re: Snort is going down sometimes... Ralf Hildebrandt
Documentation manfred . steinbacher
Problem initializing SNORT Manuel Humberto Santander Pelaez
Re: Documentation Chris Green
Re: Snort is going down sometimes... John Sage
Re: Snort is going down sometimes... Martin Roesch
RE: Error message that has me completely stumped Johnson, David
Slightly OT : Demarc Patrick . Prue
RE: FW: CodeRed: the next generation Kris Quinby
Re: Slightly OT : Demarc Blake Frantz
Re: Snort is going down sometimes... Douglas F. Elznic
Re: Re: Snort + iptables Jason Haar
problems with mysql and snort Victor Siu

Tuesday, 24 July

Re: Memory leak Michel van Osenbruggen
Limiting the events spp_stream4: WINDOW VIOLATION Tony M
Rotating '-b' logs without stopping snort? (0% data loss...) Dave Cinege
Snort 1.8 and Acid Problem Alessandro Fiorenzi
Re: Rotating '-b' logs without stopping snort? (0% data loss...) snort-users
Re: Rotating '-b' logs without stopping snort? (0% data loss...) Pawel Krawczyk
Snort-1.7 rule update HABU Takuya
Double logging Selder, Patrick [NCSBE - Non JJ]
new syslog format Jones, Benny
network output strategies (was: Rotating '-b'logs...) Kiira Triea
Re: Rotating '-b' logs without stopping snort? (0% data loss...) Johannes Grosen
Re: Double logging Martin Roesch
Re: new syslog format Martin Roesch
Re: Rotating '-b' logs without stopping snort? (0% data loss...) Ramin Alidousti
Re: Limiting the events spp_stream4: WINDOW VIOLATION Martin Roesch
newbie question Michael Fenski
Re: Rotating '-b' logs without stopping snort? (0% data loss...) Chris Keladis
RE: Logging to SnortSnarf, syslog server, or other html utility Klimarchuk John
Re: network output strategies (was: Rotating '-b'logs...) Ben Hughes
Re: RE: Logging to SnortSnarf, syslog server, or other htmlutility Jeff Holland
Snort Report 1.0 released Bora Özden
Re: Snort 1.8 and Acid Problem roman
RE: Newbie Question Klimarchuk John
Compiling libpcap (rank newbie) Robert D. Hughes
Re: RE: Newbie Question Jeff Ito
RE: Logging to SnortSnarf, syslog server, or other html utility James Hoagland
snort "seeing" nonexistant packets Lai Zit Seng
Snort-1.8.1-beta5 (build 56) available Martin Roesch
Re: Snort 1.8 and Acid Problem Alessandro Fiorenzi
Snort 1.8 and SnortSnarf Jones, Benny
Re: Acid 0.9.6b6 Reference Links roman
Re: Acid 0.9.6b6 Reference Links roman
RE: problems with mysql and snort Chris Owen
Xprobe 0.0.1p1 Ofir Arkin
Re: Rotating '-b' logs without stopping snort? (0% data loss...) Dave Cinege
RE: Rotating '-b' logs without stopping snort? (0% data loss...) Migus, Adam
Re: Rotating '-b' logs without stopping snort? (0% data loss...) Dave Cinege
snortcvs crash in InsertFrag Francois Baligant
RE: RE: Logging to SnortSnarf, syslog server, or ot her html utility Kris Quinby
RE: Slightly OT : Demarc Mark Spieth
Re: snortcvs crash in InsertFrag Martin Roesch
Monitor traffic from a specific domain? Sheahan, Paul (PCLN-NW)
Re: Monitor traffic from a specific domain? Larry E. Smith Jr.
Re: Monitor traffic from a specific domain? Robert van der Meulen
Re: snortcvs crash in InsertFrag Francois Baligant
Re: snortcvs crash in InsertFrag Martin Roesch
Spade causing seg fault Sash
Re: Monitor traffic from a specific domain? Jim Starke
bpf negation gatekeeper
RE: Double logging Selder, Patrick [NCSBE - Non JJ]

Wednesday, 25 July

ignore spp_portscan LaraCroft
Log and WinPopUp iolsmk
Acid Report: no Portscan Alessandro Fiorenzi
Re: Rotating '-b' logs without stopping snort? (0% data loss...) Ben
RE: Acid Report: no Portscan Stefan Dens
Re: Acid Report: no Portscan Andreas Hasenack
Newbie Database + Snort Peter Bates
"modprobe: can't locate.." related to snort? John Sage
Installation of Snort 1.8 on Redhat Linux 7.1 using MYSQL Larry E. Smith Jr.
Snort 1.8 with MYSQL support for WIN32 Johnson, David
RE: Acid Report: no Portscan Marcus Vinícius de Melo Rocha
RE: Installation of Snort 1.8 on Redhat Linux 7.1 u sing MYSQL Joe Stevensen
spp_arpspoof auto241065
Re: Spade causing seg fault James Hoagland
Re: Snort 1.8 with MYSQL support for WIN32 Larry E. Smith Jr.
Re: spp_arpspoof bill . marquette
Snort 1.8 on Redhat 7.1 Larry E. Smith Jr.
snort automaticly rules update alexus
Re: Snort 1.8 on Redhat 7.1 Dr SuSE
Re: snort automaticly rules update Dr SuSE
RE: snort automaticly rules update Ian
RE: snort automaticly rules update Dr SuSE
Fatal Error OpenLogFile Scott
RE: Fatal Error OpenLogFile Scott
RE: Fatal Error OpenLogFile Chris Owen
RE: Fatal Error OpenLogFile Scott
RE: Fatal Error OpenLogFile Klimarchuk John
Re: Fatal Error OpenLogFile J. C. Woods
snort 1.7 vs snort 1.8p1 less info.. why? alexus
Re: snort 1.7 vs snort 1.8p1 less info.. why? Dr SuSE
RE: snort 1.7 vs snort 1.8p1 less info.. why? David Gullett
Re: Newbie Database + Snort Jed Pickel
Re: snort 1.7 vs snort 1.8p1 less info.. why? Jim Forster
RE: Installation of Snort 1.8 on Redhat Linux 7.1 using MYSQL Jason Lewis
MySQL DB creation error Jason Lewis
RE: Snort 1.8 with MYSQL support for WIN32 Frank Knobbe
RE: MySQL DB creation error Jason Lewis
Weird coredump w/ snort Charles Henrich
Questions about database (PostgreSQL) Deven Phillips
Re: Weird coredump w/ snort Martin Roesch
RE: Fatal Error OpenLogFile Scott
Re: Questions about database (PostgreSQL) Jed Pickel
RE: Fatal Error OpenLogFile Erek Adams
Re: Questions about database (PostgreSQL) Phil Wood
Re: Questions about database (PostgreSQL) roman
RE: Fatal Error OpenLogFile Scott
issue with logging... Anthony Geoffron
RE: Fatal Error OpenLogFile Scott
Re: "modprobe: can't locate.." related to snort: Yes. John Sage
WinpopUp and MySQL iolsmk
brut force attack not detected Anthony Geoffron

Thursday, 26 July

RE: Fatal Error OpenLogFile Erek Adams
Chroot Cell Erek Adams
The pattern-matching evasion to network ids wangyc
RE: Rules database working under win32/IDScenter Klimarchuk John
Re: Questions about database (PostgreSQL) Hugh Fraser
RE: brut force attack not detected John Berkers
Arachnids references in snort 1.8 rules John Berkers
Snort, ACID, MySQL performance optimizations Chris Schuler
How to Get Snort 1.8.1b4 to write to /var/log/secure Jon Naumann
Re: The pattern-matching evasion to network ids Martin Roesch
RE: brut force attack not detected Franki
Re: Snort, ACID, MySQL performance optimizations roman
snort causes "modprobe: can't locate.." in syslog John Sage
Re: Snort 1.8 on Redhat 7.1 frogball
Acid 0.9.6bx Portscan problem bthaler
spp_stream4 preprocessor problem tdangler
Re: Arachnids references in snort 1.8 rules Brian Caswell
Re: False alarm due to wrong byteordering Ralf Hildebrandt
Re: brut force attack not detected Kiira Triea
Re: snort causes "modprobe: can't locate.." in syslog Kiira Triea
RE: brut force attack not detected Matthew Francis
[OT] RE: brut force attack not detected Graeme Fowler
RE: Snort, ACID, MySQL performance optimizations roman
RE: brut force attack not detected Paul Smith
RE: Acid 0.9.6bx Portscan problem Stefan Dens
Re: False alarm due to wrong byteordering Martin Roesch
RE: brut force attack not detected Graeme Fowler
Re: spp_stream4 preprocessor problem Martin Roesch
PIII vs Athlon vs SPARC Avleen Vig
RE: Acid 0.9.6bx Portscan problem roman
Packet Motel (was: brut force attack not detected) Kiira Triea
Re: snort 1.7 vs snort 1.8p1 less info.. why? Brian Caswell
Error message questions Ronnie Clark
Dynamic Rules Jason Robertson
Where to find latest snort_stat? - link at www.snort.org busticated Kirk Grier
Re: Questions about database (PostgreSQL) Jason Robertson
Re: snort 1.7 vs snort 1.8p1 less info.. why? alexus
Re: snort 1.7 vs snort 1.8p1 less info.. why? alexus
RE: WIN32 using Snort 1.7, IDScenter Klimarchuk John
Rule updating script, Oinkmaster v0.1. Andreas Östling
Re: Dynamic Rules Chris Green
Re: snort 1.7 vs snort 1.8p1 less info.. why? Patrick Hawley
ACID Graphing Frank Reid
Help with custom rule Sheahan, Paul (PCLN-NW)
More Info - brut force attack not detected Anthony Geoffron
RE: Help with custom rule Dell, Jeffrey
Re: Help with custom rule Jim Forster
Re: snort 1.7 vs snort 1.8p1 less info.. why? alexus
Re: Questions about database (PostgreSQL) Jed Pickel
Re: Questions about database (PostgreSQL) Jason Robertson
Re: snort causes "modprobe: can't locate.." in syslog John Sage
Re: snort causes "modprobe: can't locate.." in syslog Ian Jones
snortpp: Tired of your snort crashing on rules? Dragos Ruiu
Individual rule msg definitions Scott
Win32-snort 1.8 H C
RE: snort automaticly rules update Dragos Ruiu
RE: Win32-snort 1.8 Frank Knobbe

Friday, 27 July

Re: False alarm due to wrong byteordering Ralf Hildebrandt
Re: Individual rule msg definitions Dragos Ruiu
RE: snortpp: Tired of your snort crashing on rules? Dragos Ruiu
Different sadmind exploit Mayers, Philip J
RE: Win32-snort 1.8 Michael Davis
RE: Win32-snort 1.8 Michael Davis
http contents chris_chris
OT: daemontools Williams Jon
Re: OT: daemontools Chris Green
Re: OT: daemontools Ralf Hildebrandt
Re: OT: daemontools Erik Fichtner
Re: ACID Graphing roman
RE: Individual rule msg definitions Scott
portscan preprocessor in 1.8p1 Andreas Steinmetz
RE: RE: WIN32 using Snort 1.7, IDScenter Klimarchuk John
Re: Individual rule msg definitions Chris Green
RE: Win32-snort 1.8 Chris Reid
snortrules.tar.gz Jason Smith
RE: snortrules.tar.gz Chris Owen
RE: Help with custom rule Sheahan, Paul (PCLN-NW)
How to add subnet minus host in rule definition? Charles Henrich
RE: snortrules.tar.gz Jason Lewis
RE: portscan preprocessor in 1.8p1 Neal Timm
Re: Fixed: "modprobe: can't locate.." in syslog John Sage

Saturday, 28 July

Re: How to add subnet minus host in rule definition? Dragos Ruiu
snort_stat.pl and xanadu.incident.org Yen-Ming Chen
How to log to a MySQL database Daniel Holden
Logging to a mysql database question Daniel Holden
RE: How to log to a MySQL database Jason Lewis
Re: Logging to a mysql database question Phil Wood
Snort 1.8p1 crashing after about a day. Sebastian Ip
RE: Snort 1.8p1 crashing after about a day. John Berkers
Re: Snort 1.8p1 crashing after about a day. Martin Roesch
remote logging without IP aie man

Sunday, 29 July

Re: remote logging without IP Fyodor
Snort and SNMP Wiley, Rob
Re: Snort and SNMP Dragos Ruiu
packet loss statistics under Linux Dragos Ruiu
Re: Double logging Martin Roesch
Re: packet loss statistics under Linux Martin Roesch
Re: packet loss statistics under Linux Fyodor
Re: packet loss statistics under Linux Guy Harris

Monday, 30 July

Re: Re: OT: daemontools Marsiske Stefan
Cisco PPTP DoS Details? Dragos Ruiu
Re: Snort Newbie questions regarding Win2k vs Linux/Unix James Hoagland
code red worm jaywhy
Re: code red worm Dr SuSE
Snort 1.8b5 dumping core Charles Henrich
RE: code red worm Steve Halligan
Multiple logging destinations Steve Nold
snort stops after a while Gabriele Peresson
snort 1.7 with mysql support for win32 crashes after a few minutes Todd Ransom
Code Red Rule Richard Parker
RE: snort 1.7 with mysql support for win32 crashes after a few minutes Steve Halligan
Code Red Rule? Richard Parker
Re: Snort 1.8b5 dumping core Martin Roesch
Snort detection engine vulnerability Moritz Jodeit
Re: Snort detection engine vulnerability James Hoagland
Re: Snort detection engine vulnerability Dragos Ruiu
RE: Snort detection engine vulnerability Jason Lewis
Frequent binary log rotation data lose Dave Cinege
Re: Snort detection engine vulnerability Dragos Ruiu
Re: Snort and SNMP Chris Green
Hate to bring this up... Mike Diehn
Acid TCP options Selder, Patrick [NCSBE - Non JJ]

Tuesday, 31 July

Re: Snort and SNMP Dragos Ruiu
Re: Snort detection engine vulnerability Yoann Vandoorselaere
Message status - undeliverable Mailer-Daemon
Packet contents? Joerg Weber
What are the "other" protocols? Jones, Benny
RE: Code Red Rule? John Berkers
Re: What are the "other" protocols? John Sage
RE: Snort and SNMP Wiley, Rob
Snort 1.8p1, Acid 0.9.6b13 and a little MySQL lovin' Chris Schuler
Re: Snort 1.8p1, Acid 0.9.6b13 and a little MySQL lovin' roman
snort_stat.pl 1.15.2.3 Yen-Ming Chen
Re: What are the "other" protocols? Phil Wood
(no subject) Blake Frantz
ACID CVS (and .13 i think) Graphing Chris Schuler
Snort/Acid/MySql on Win2000 problem. Jarmoc, Jeff
Re: Snort and SNMP Glenn Mansfield Keeni
Re: Snort/Acid/MySql on Win2000 problem. roman
Re: Hate to bring this up... Erek Adams
Snort with Mysql & ACID on FreeBSD, Schema problem? Tom Sevy
ACID Dominick, David
RE: ACID Jarmoc, Jeff
snort on FreeBSD 4.3 help Brent Bailey
Re: ACID Dr SuSE
FBSD 4.3 help w/ snort config Brent Bailey
RE: ACID Tom Sevy
Re: ACID J. C. Woods
RE: ACID Dominick, David
Re: Packet contents? Joe McAlerney
test Dr SuSE
RE: FBSD 4.3 help w/ snort config William A Kruchas
CRv3?? [was RE: Code Red Rule?] Mike Baptiste
logging portscans to MySQL Mike Diehn
Re: Snort with Mysql & ACID on FreeBSD, Schema problem? roman
RE: CRv3?? [was RE: Code Red Rule?] Chris Owen
Re: CRv3?? [was RE: Code Red Rule?] Douglas R. Wilson
dummy listener? Steven V. Jackson
Re: CRv3?? [was RE: Code Red Rule?] Mike Baptiste
Re: dummy listener? Steven V. Jackson
Re: dummy listener? roel
Getting started Julia A. Case
Re: CRv3?? [was RE: Code Red Rule?] Andreas Brenk
IDS Policy Manager 1.0 Release Jeff Dell
Re: logging portscans to MySQL Jed Pickel
Re: Getting started stdfk
Re: Getting started Julia A. Case
Remote management of snort Vikalp Nagori
Re: Remote management of snort Jed Pickel
Only thing logged is IMAP requests Phil

Wednesday, 01 August

Re: (no subject) Niek Jongerius
Defining $EXTERNAL_NET Gisli Helgason
RE: Remote management of snort John Berkers
RE: Defining $EXTERNAL_NET John Berkers
Linux and packet loss Matthew Collins
Re: Linux and packet loss Chris Green
.ida attempt vs .ida access Julia A. Case
Re: logging portscans to MySQL Mike Diehn
Re: .ida attempt vs .ida access Chris Green
excessive numbers of Possible RETRANSMISSION detected diphen
Re: excessive numbers of Possible RETRANSMISSION detected Julia A. Case
log rotation scripts? Migus, Adam
Re: excessive numbers of Possible RETRANSMISSION detected Chris Green
Re: excessive numbers of Possible RETRANSMISSION detected diphen
SnortSnarf version 080101.1 James Hoagland
Re: excessive numbers of Possible RETRANSMISSION detected Chris Green
Re: excessive numbers of Possible RETRANSMISSION detected diphen
RE: log rotation scripts? Jason Smith
Trouble with Rules File Anupam Bansal
Re: Trouble with Rules File Dragos Ruiu
Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss) Jason Haar
RE: log rotation scripts? Dragos Ruiu
Linksys alert messages Dragos Ruiu
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss) Dragos Ruiu
snort without authentication Rick Francis
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss) Jason Haar
high speed snorting Christian Kuhtz
Functional suggestion for Acid Thomas Nilsen
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss) Steve Williams

Thursday, 02 August

RE: How to Get Snort 1.8.1b4 to write to /var/log/secure Erik Norman
Re: Linksys alert messages Andrew R. Baker
Re: Linux and packet loss Matthew Collins
a little perl and a touch of cron Sean Wheeler
Mailing list for IDS margardi
newbie to snort jevon
newbie to snort jevon
Setting up SnortDB Chris Eidem
Re: a little perl and a touch of cron Andreas Brenk
Editing HOME_NET variable Dallam
crashing on 1.8-beta5 no longer Daniel Monjar
acid cvsup as of 02-08-2001 Mark Rowlands
Re: high speed snorting Simon E. Devlin
Re: Linksys alert messages Joe McAlerney
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss) Daniel Harrison
Re: snort without authentication Erek Adams
RE: How to Get Snort 1.8.1b4 to write to /var/log/secure Erek Adams
Re: newbie to snort Erek Adams
Re: Mailing list for IDS pbsarnac
Interface settings - noarp, promisc... Subba Rao
Newbie ACID config problem Scott Phippen
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet Dr SuSE
RE: Newbie ACID config problem Kevin Brown
RE: high speed snorting Eric Rosander
Re: log rotation scripts? Dr SuSE
gtkscan Dominick, David
RE: Setting up SnortDB Chris Eidem
Re: newbie to snort Dragos Ruiu
Re: Welcome to the "Snort-users" mailing list Richard Rico
unable to open rules file clssification.config Richard Rico
newbie to snort jevon
Re: newbie to snort Dragos Ruiu
RE: Newbie ACID config problem John Berkers
Re: newbie to snort Jim Forster
Re: unable to open rules file clssification.config Julia A. Case
Re: unable to open rules file clssification.config Dragos Ruiu
Re: unable to open rules file clssification.config Chris Green
upgrading ACID Todd Ransom
Re: Linux and packet loss Jason Haar
spp_http_decode rules Ken Mencher
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss Jason Haar
Re: Linux and packet loss Martin Roesch
Re: Linux and packet loss Jason Haar
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss Andreas Östling
Re: Linux and packet loss Phil Wood
ACID and MySQL questions Jason Lewis
Re: Editing HOME_NET variable J. C. Woods
high speed snorting Thomas Porter, Ph.D.
Re: Editing HOME_NET variable John Sage
upgrading ACID Michael Steele
snort 1.8.1 build 56 segmentation fault / Solaris 2.7 wolfgang . schlueschen
Re: a little perl and a touch of cron Jörgen Persson
Re: a little perl and a touch of cron Jörgen Persson

Friday, 03 August

Re: a little perl and a touch of cron Jörgen Persson
RE: spp_http_decode rules John Berkers
Re: ACID and MySQL questions meling
OT: list for discussing incidents Todd Ransom
Re: upgrading ACID Todd Ransom
RE: OT: list for discussing incidents Dell, Jeffrey
Re: OT: list for discussing incidents Todd Ransom
Differentiated rights for users Tudor Panaitescu
SnortDB question Julia A. Case
FreeBSD promisc not working properly B Keffer
Re: Differentiated rights for users- Please disregard Tudor Panaitescu
Snort Segmentation Fault George D. Nincehelser
snort_stat question Sheahan, Paul (PCLN-NW)
Tear drop attack. Anupam Bansal
(no subject) Anupam Bansal
RE: SnortDB question Fraser Hugh
Snort-users digest, Vol 1 #877 - 11 msgs ( -VACATION-Reply) John Lloyd
Re: SnortDB question Julia A. Case
IDS296/web-misc_http-whisker-splicing-attack-space tnelson
Re: IDS296/web-misc_http-whisker-splicing-attack-space Andrew R. Baker
Re: SnortDB question Erek Adams
Re: IDS296/web-misc_http-whisker-splicing-attack-space tnelson
(no subject) Patrick W Bass
Re: SnortDB question Travis Dawson
Re: (no subject) Dragos Ruiu
Why Code Red is never going to Spread Exponentially Gary Warner

Saturday, 04 August

off-topic: HAL (anyone?) Fyodor
RE: IDS296/web-misc_http-whisker-splicing-attack-space John Berkers
Add'l lookup info from within ACID? Tom Sevy
Re: Add'l lookup info from within ACID? John Sage
Log file problem Ush
Why all the rules parsing errors? Don Heffernan
Re: Why all the rules parsing errors? Andrew R. Baker
Re: Why all the rules parsing errors? Dragos Ruiu
Re: Why all the rules parsing errors? John Sage
Code Red II jaywhy
Re: Why all the rules parsing errors? Don Heffernan
Re: Re: Why all the rules parsing errors? Shawn Foley
series of questions succendo
CodeRed Question Kevin
Code Red II Murphy

Sunday, 05 August

Re: Log file problem Ralf Hildebrandt
Re: Log file problem Dave Cinege
Problem with Rules John Davey
Re: Log file problem Ush
Re: Re: Log file problem Jörgen Persson
Re: Log file problem Ush
Managing Snort sensors chris_chris
Re: Re: Log file problem Ralf Hildebrandt
Re: Re: Log file problem Rob Whelan
Re: Managing Snort sensors Rob Whelan
Re: Log file problem Ush
Re: Log file problem Ush
Re: Re: Log file problem Ralf Hildebrandt
Re: series of questions John Sage
Re: series of questions jrd
Re: Log file problem Ush
Help Advanced Hosting UNIX Admin Daniel Fairchild
Re: Help John Sage
RE: logfile Kent Freeman
Problem with Code Red signature Jyri Hovila
Detecting VNC, PCAnywhere etc. Sheahan, Paul (PCLN-NW)
probe alerts Jim Hankins
RE: Detecting VNC, PCAnywhere etc. Mark Spieth
Re: Re: Log file problem Jörgen Persson
RE: Problem with Code Red signature Graeme Fowler
RE: probe alerts Jyri Hovila
RE: Problem with Code Red signature Jyri Hovila
Snort and 64-bit UltraSparc IIe Wiley, Rob
anyone have any trouble getting guardian to work Advanced Hosting UNIX Admin Daniel Fairchild
RE: anyone have any trouble getting guardian to work Jyri Hovila
RE: probe alerts Jyri Hovila
Logging to snort log and mySQL - how to? John Hall
Re: Logging to snort log and mySQL - how to? Andrew R. Baker
New Code Red Variant Jim Hankins
Help - getting tcpdump format out of a database Deterding, Brent D
brain not working re tcpdump format out of DB Deterding, Brent D
Rules: reliably ignoring a host Chris Adams
RE: New Code Red Variant John Davey

Monday, 06 August

Log questions Phil
libpcap and ppp vs. ether Phil
Re: series of questions Alex David Shadrach Hooper
What to do with CodeRed(II) logged hosts ? ks
Re: What to do with CodeRed(II) logged hosts ? Mark Rowlands
libpcap and iptables Jyri Hovila
RE: Log questions Jyri Hovila
Antwort: Re: What to do with CodeRed(II) logged hosts ? ks
What to do with CodeRed(II) logged hosts ? Jyri Hovila
RE: Help John Berkers
Re: Rules: reliably ignoring a host Martin Roesch
RE: Problem with Code Red signature John Berkers
Re: Log questions Martin Roesch
Re: series of questions Alex David Shadrach Hooper
the meaning with arrows in alerts? Pontus Joakimsson
Help with logging structure Gerardo Gregory
RE: the meaning with arrows in alerts? Jyri Hovila
Re: What to do with CodeRed(II) logged hosts ? Thierry Coopman
Autamtic Rules Update Ivan Hernandez
Re: the meaning with arrows in alerts? Martin Roesch
Evasive RST? George D. Nincehelser
RE: Autamtic Rules Update Ivan Hernandez
Re: Autamtic Rules Update Wesley Eddy
RE: Autamtic Rules Update Dell, Jeffrey
Re: What to do with CodeRed(II) logged hosts ? Ryan Russell
Re: Autamtic Rules Update Wesley Eddy
Re: Evasive RST? Robert van der Meulen
Sneeze v 1.0 released--Snort false-positive generator in Perl Don Bailey
ACID -- missing signature? Peter Bates
ACID -- missing signature? (addendum) Peter Bates
Snort & Firewall Stephen Torri
logging both TCPdump dump and fast format. Anthony Geoffron
Re: "Attempt to execute cmd" surge! Ryan Russell
"Attempt to execute cmd" surge! Sheahan, Paul (PCLN-NW)
covert channel detection? Sheahan, Paul (PCLN-NW)
RE: "Attempt to execute cmd" surge! Steve Halligan
Snort service stop gerhard
Re: covert channel detection? Chris Green
ACID 0.9.6b13+ and DB schema v0 (Snort 1.7) roman
Re: Rules: reliably ignoring a host Chris Adams
Re: What to do with CodeRed(II) logged hosts ? Bob Bernstein
Cmd.exe requests Tom Sevy
Parse error James Friesen
RE: Snort service stop Oxenreider, Jeff
Are new rules posted anywhere? Don Heffernan
Re: Snort service stop Tim Sailer
Snort Restarter and Crash Logger (was Re: Re: Log file problem) Dragos Ruiu
Re: Cmd.exe requests ktimm
Re: FIX: ACID 0.9.6b13+ and DB schema v0 (Snort 1.7) roman
Re: Snort service stop Ralf Hildebrandt
RE: Snort service stop Ken Mencher
Evasive RST's JSeddon
RE: Cmd.exe requests Anthony Geoffron
Re: Snort & Firewall John Sage
Definitive Code Red rule Migus, Adam
The new Code Alert Anthony Geoffron
rules.c:3426: failed assertion `idx->func != NULL' Peter Radcliffe
Snort Dumps.... JSeddon
Re: How to Get Snort 1.8.1b4 to write to /var/log/secure Tony Lill
Snort-1.8.1-beta6 available Martin Roesch
Re: Snort service stop Jed Pickel
Re: ACID parse error roman
Snort and 64-bit UltraSparc IIe Wiley, Rob
Re: Snort & Firewall Stephen Torri
Re: Snort Dumps.... George D. Nincehelser
ACID and ICMP James Kelty
need help Eduard Meiler
Re: Cmd.exe requests Jason
snort-1.8 and mysql timestamp problem... Michael Teng
Re: Cmd.exe requests Ryan Russell
Re: ACID and MySQL questions roman
RE: ACID and MySQL questions Jason Lewis
libnet.h missing error when makeing under RHAT7.1 Jim Hankins
RE: ACID and MySQL questions roman
Re: Snort & Firewall John Sage
Re: libnet.h missing error when makeing under RHAT7.1 J. C. Woods
Re: ACID and MySQL questions Rob Whelan
Re: libnet.h missing error when makeing under RHAT7.1 diphen
RE: Snort-users digest, Vol 1 #890 - 10 msgs Milton Sullivan
Blocking not friendly traffic ������� �������
Re:Blocking not friendly traffic Shaiful
Re: Blocking not friendly traffic Jeff
Re: Blocking not friendly traffic Ralf Hildebrandt
Re: Blocking not friendly traffic Ralf Hildebrandt

Tuesday, 07 August

Antwort: Re: Blocking not friendly traffic ks
Antwort: The new Code Alert ks
Re: Antwort: Re: Blocking not friendly traffic Dragos Ruiu
Antwort: Re: Antwort: Re: Blocking not friendly traffic ks
Re: Antwort: The new Code Alert J. C. Woods
What does VECNA mean ? Togan Muftuoglu
Re: libnet.h missing error when makeing under RHAT7.1 Kiira Triea
false positives Vail
Re: covert channel detection? Ralf Hildebrandt
Re: covert channel detection? Hugh Fraser
Fwd: false positives Vail
Support Issues Oxenreider, Jeff
Cod Red HELP!!!! Advanced Hosting UNIX Admin Daniel Fairchild
Re: Cod Red HELP!!!! Ralf Hildebrandt
RE: Cod Red HELP!!!! van Oosterom, Peter
Re: Cod Red HELP!!!! Ralf Hildebrandt
FW: Parse error James Friesen
RE: Cod Red HELP!!!! Theo Zourzouvillys
Re: FW: Parse error roman
RE: Cod Red HELP!!!! Mark Spieth
Php3 & Mysql alert script acz [iSecureLabs]
Problems reading dump files Pete Schuyler
question about ip-range in rules Pontus Joakimsson
Re: Cod Red HELP!!!! s I n
Re: RE: Cod Red HELP!!!! Jed Haile
Re: Cod Red HELP!!!! Lance Spitzner
OT: Oddity with CRII Erek Adams
All Things Spam.... Erek Adams
RE: Cod Red HELP!!!! Nigel Morse
RE: OT: Oddity with CRII Mark Spieth
Re: Definitive Code Red rule Ush
Re: Re: Definitive Code Red rule Brian Caswell
RE: Re: Definitive Code Red rule Eric Johansen
Re: Re: Definitive Code Red rule Erek Adams
RE: OT: Oddity with CRII Erek Adams
RE: OT: Oddity with CRII Ryan Russell
Snort activate niko
Re: Re: Definitive Code Red rule Brian Caswell
RE: Re: Definitive Code Red rule Steve Halligan
False alerts generated when FTP'ing Redhat ISO images ... Low, Adam
Database logging Mayers, Philip J
Re: Snort activate Martin Roesch
Problems reading dump files Pete Schuyler
Misc patches Mayers, Philip J
missing file Jace Alexander
RE: Cod Red HELP!!!! s I n
RE: missing file Kevin Brown
SNORT Binary Core Dumps Timothy Barhorst
RE: Cod Red HELP!!!! Carolyn Beckman
Re: SNORT Binary Core Dumps Joe McAlerney
Re: SNORT Binary Core Dumps Martin Roesch
Re: SNORT Binary Core Dumps George D. Nincehelser
Code Red and port 443 (was RE: Code Red HELP!!!!) George D. Nincehelser
Re: ACID and ICMP roman
(no subject) Scott Phelps
RE: Snort activate Anthony Geoffron
RE: CodeRed from non-IIS machines??? Kevin Brown
CodeRed from non-IIS machines??? Tom Kyle
Re: False alerts generated when FTP'ing Redhat ISO images ... Mike Johnson
RE: Cod Red HELP!!!! s I n
Re: Code Red and port 443 (was RE: Code Red HELP!!!!) Carolyn Beckman
RE: Help with logging structure John Berkers
HUP causes wierd msgs in snort-1.8.1-beta6 Jason Haar
Re: HUP causes wierd msgs in snort-1.8.1-beta6 Erek Adams
[Q] Anybody Mandrake 8.0 and snort-1.8p1-0 ?!? stefmit
Re: HUP causes wierd msgs in snort-1.8.1-beta6 Jason Haar
How to block a brut force attack? Anthony Geoffron
Re: How to block a brut force attack? Ramin Alidousti
ANNOUNCE: logsnorter v0.2. Merge Linux/BSD/Cisco access-lists into snort Jason Haar
SnortReport Chris Adams
Re: CodeRed from non-IIS machines??? Tom Kyle
Re: SnortReport Julia A. Case
Re: How to block a brut force attack? Robert van der Meulen
RE: How to block a brut force attack? Anthony Geoffron
RE: CodeRed from non-IIS machines??? Kris Quinby
Snort 1.8 WIN32 Larry E. Smith Jr.
Re: SnortReport Chris Adams
Snort DB alertfile import Hall, Andrew
Re: Snort DB alertfile import Andreas Hasenack
Re: Snort Restarter and Crash Logger (was Re: Re: Log file problem) Kyle R Maxwell
Re: RE: Cod Red HELP!!!! Kyle R Maxwell
Re: Snort Restarter and Crash Logger (was Re: Re: Log file problem) Dragos Ruiu
Re: Database logging Jed Pickel
ACID and MySQL DB timeouts Paulie
Re: ACID and MySQL DB timeouts Robert van der Meulen
Re: ACID and MySQL DB timeouts Alain T�sio

Wednesday, 08 August

Re: RE: Cod Red HELP!!!! s I n
snort-1.8 with ACID akshaye kalkura
Re:[Q] Anybody Mandrake 8.0 and snort-1.8p1-0 ?!? Jon
Re: Code Red and port 443 (was RE: Code Red HELP!!!!) Thierry Coopman
RE: Database logging Mayers, Philip J
accuracy of snort? Pontus Joakimsson
Snort 1.81Beta6 build 64 broken stream4? Andrew Cogger
RE: accuracy of snort? Mayers, Philip J
win32 Fyodor
Don't create directories on special events ? ks
RE: win32 Ewout Meij
Re: ACID and MySQL DB timeouts Andreas Hasenack
Re: accuracy of snort? Kiira Triea
Re: snort-1.8 with ACID roman
Re: Code Red and port 443 (was RE: Code Red HELP!!!!) Mike Johnson
RE: accuracy of snort? Sloan, Craig
Re: Re: Code Red and port 443 (was RE: Code Red HELP!!!!) Marsiske Stefan
Re: Snort 1.81Beta6 build 64 broken stream4? Jason A. Haynes
Re: Code Red and port 443 (was RE: Code Red HELP!!!!) Mike Johnson
External snort monitoring Larry E. Smith Jr.
1.8.1-beta6 = no crashes with FreeBSD 4.3-STABLE Mike Squires
Re: External snort monitoring Frank McPherson
Re: External snort monitoring Frank McPherson
Re: External snort monitoring George D. Nincehelser
Re: win32 Chris Reid
Re: HUP causes wierd msgs in snort-1.8.1-beta6 Erek Adams
Re: External snort monitoring Larry E. Smith Jr.
Re: RE: Cod Red HELP!!!! Erek Adams
1.8.1-beta6 Snort Still Core Dumps Timothy Barhorst
Re: External snort monitoring Erek Adams
Re: Code Red and port 443 (was RE: Code Red HELP!!!!) Erek Adams
Re: External snort monitoring Security @ Monster-Solutions.Net
Re: 1.8.1-beta6 Snort Still Core Dumps Julia A. Case
RE: External snort monitoring swilcoxon
Re: Don't create directories on special events ? Martin Roesch
Re: accuracy of snort? Martin Roesch
RE: External snort monitoring Steve Halligan
Re: RE: Cod Red HELP!!!! tibuq
Re: 1.8.1-beta6 Snort Still Core Dumps Martin Roesch
Oracle as database Andrew Stubbs
Re: Re: [Snort-users] win32 Martin Roesch
Re: Snort 1.81Beta6 build 64 broken stream4? Martin Roesch
Packet for second Alessandro Fiorenzi
hELP IN FILTERING Gerardo Gregory
RE: ACID and MySQL DB timeouts Dominick, David
Snort 1.81Beta6 latest build, compile fails Neil Dickey
FAQ 10/100 Hubs Block Other Speed Traffic (was: RE: External snort monitoring) Dragos Ruiu
RE: FAQ 10/100 Hubs Block Other Speed Traffic (was: RE: External snort monitoring) Franki
Re: FAQ 10/100 Hubs Block Other Speed Traffic Erek Adams
Re: Re: FAQ 10/100 Hubs Block Other Speed Traffic Larry E. Smith Jr.
RE: FAQ 10/100 Hubs Block Other Speed Traffic Erek Adams
Antwort: Re: Don't create directories on special events ? ks
RE: Re: FAQ 10/100 Hubs Block Other Speed Traffic Steve Halligan
RE: FAQ 10/100 Hubs Block Other Speed Traffic (was: RE: External snort monitoring) Rich Adamson
Two coredump bugs in 1.8p1 Kris Kennaway
Re: Antwort: Re: Don't create directories on special events ? Erek Adams
Re: Oracle as database Jed Pickel
Re: Re: FAQ 10/100 Hubs Block Other Speed Traffic Rich Adamson
Re: Re: FAQ 10/100 Hubs Block Other Speed Traffic Erek Adams
RE: Re: FAQ 10/100 Hubs Block Other Speed Traffic Rich Adamson
Re: ACID and MySQL DB timeouts Jed Pickel
Re: Re: FAQ 10/100 Hubs Block Other Speed Traffic Rich Adamson
Re: FAQ 10/100 Hubs Block Other Speed Traffic (was: RE: External snort monitoring) Ramin Alidousti
RE: FAQ 10/100 Hubs Block Other Speed Traffic (was: RE: [Snort-users] External snort monitoring) Jason
Re: FAQ 10/100 Hubs Block Other Speed Traffic (was: RE: [Snort-users] External snort monitoring) Jim Hankins
Re: FAQ 10/100 Hubs Block Other Speed Traffic stefmit
acid + archive db Jason
Re: acid + archive db roman
RE: ANNOUNCE: logsnorter v0.2. Merge Linux/BSD/Cisco access-lists into snort Jason Lewis
Windows BETA BETA BETA 1.8.1 Snort Release Michael Steele
SnortReport update Chris Adams
Re: Code Red and port 443 (was RE: Code Red HELP!!!!) Jason Haar
snort-1.8.1-beta7 available Martin Roesch
Re: FAQ 10/100 Hubs Block Other Speed Traffic Murphy

Thursday, 09 August

core dumps Neal Timm
snort start Birkir Björnsson
Re: Re: FAQ 10/100 Hubs Block Other Speed Traffic Dragos Ruiu
RE: snort start John Berkers
snort-1.8.x, libz, solaris and LD_LIBRARY_PATH Mike Diehn
snort_stat.pl version 1.15.2.3 parsing problem Erik Norman
Re: core dumps Martin Roesch
RE: snort-1.8.x, libz, solaris and LD_LIBRARY_PATH Kevin Brown
Windows NT Instalation etienne
Re: Re: FAQ 10/100 Hubs Block Other Speed Traffic Larry E. Smith Jr.
AW: Windows NT Instalation Pesek Wolfgang (Mail)
Snort Report 1.03 Released David Gullett
RE: snort-1.8.1-beta7 available Mayers, Philip J
Selectively disabling some stream4 alerts Kevin M. Myer
Re: Re: FAQ 10/100 Hubs Block Other Speed Traffic Jeff Ito
RE: snort-1.8.1-beta7 available Neil Dickey
Re: snort-1.8.x, libz, solaris and LD_LIBRARY_PATH Erek Adams
Re: Selectively disabling some stream4 alerts Erek Adams
RE: Windows NT Instalation Ben Johansen
Re: Re: FAQ 10/100 Hubs Block Other Speed Traffic Larry E. Smith Jr.
re: snort_stat.pl version 1.15.2.3 parsing problem Andy Bach
RE: Windows NT Instalation Frank Knobbe
Re: snort-1.8.1-beta7 available Martin Roesch
Re: snort-1.8.1-beta7 available Martin Roesch
Snort Exits Mysteriously vigilant
Snort Report error Julia A. Case
RE: Windows NT Instalation Ben Johansen
acid simple question from a noobie Dominick, David
Segmentation fault (core dumped) Dominick, David
Re: Segmentation fault (core dumped) Erek Adams
RE: snort-1.8.x, libz, solaris and LD_LIBRARY_PATH Clausing, James A (Jim), SOBUS
RE: Windows NT Installation Dennis Cooper
Re: Snort Report error Chris Adams
Re: acid simple question from a noobie Joe McAlerney
RE: Snort Exits Mysteriously Martijn Heemels
whitehats.com unreachable? Martijn Heemels
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss) Martin Roesch
New Snort Module for Webmin Mike Baptiste
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss) Martin Roesch
Snort 1.8.1BETA Release - WINDOWS Michael Steele
Re: snort-1.8.x, libz, solaris and LD_LIBRARY_PATH Mike Diehn
ACID Detection Time error Kevin Brown
Re: Two coredump bugs in 1.8p1 Kris Kennaway
RE: RE: FAQ 10/100 Hubs Block Other Speed Traffic (was: RE: [Snort-users] External snort monitoring) James Friesen
Re: Two coredump bugs in 1.8p1 Kris Kennaway
Re: Two coredump bugs in 1.8p1 Andrew R. Baker
(no subject) Delfim Machado
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss) Jason Haar
Re: ACID Detection Time error roman
Re: Loosing alerts with 1.8.1-beta5 (was: Linux and packet loss) Martin Roesch
--with-mysql make warning meling
session reassembly on windows chris_chris

Friday, 10 August

Re: Snort Exits Mysteriously Pontus Joakimsson
RE: whitehats.com unreachable? John Berkers
Re: Snort Exits Mysteriously J. C. Woods
snort start Birkir Björnsson
RE: RE: FAQ 10/100 Hubs Block Other Speed Traffic (was: RE: [Snort-users] External snort monitoring) James Friesen
Sudden surge of MISC IP Reserved bit set Tom Sevy
Question? James Friesen
RE: session reassembly on windows Frank Knobbe
Re: session reassembly on windows Joe McAlerney
external net Birkir Björnsson
RE: external net Kevin Brown
Re: external net Pontus Joakimsson
external net Murphy
DB Schema Andrew Stubbs
Re: session reassembly on windows Martin Roesch
false attacks Birkir Björnsson
RE: snort-1.8.1-beta7 available Mayers, Philip J
RE: DB Schema Kevin Brown
Re: Sudden surge of MISC IP Reserved bit set Phil Wood
bpf madness Todd Ransom
RE: Cod Red HELP!!!! Shriman Gurung
Re: Sudden surge of MISC IP Reserved bit set John Sage
Re: Sudden surge of MISC IP Reserved bit set Phil Wood
Re: Question? Jed Pickel
CODE RED III Mark Spieth
Re: CODE RED III Mike Baptiste
snort -s and -l at the same time? Sven Olensky
Snort 1.8.1 BETA 7 Release - WINDOWS - New Binaries Michael Steele
Snort 1.7 MySQL Question bthaler
Re: Cod Red HELP!!!! Advanced Hosting UNIX Admin Daniel Fairchild
Re: Sudden surge of MISC IP Reserved bit set Martin Roesch
SRC x DST address after packet reassembly Marcus Rocha
Re: Snort 1.7 MySQL Question Jason
[anno] snort_stat.pl 1.15.2.4 released Yen-Ming Chen
RE: Snort 1.7 MySQL Question swilcoxon
RE: Snort 1.7 MySQL Question Johnson, David
Re: Snort 1.7 MySQL Question Mark Rowlands
snort_stat.pl 1.15.2.4 released w
snort woes Jim Starke
Re: snort woes Phil Wood

Saturday, 11 August

spp_portscans Dan
beta 8 available Martin Roesch
Re: snort woes Jim Starke
Re: snort woes J. C. Woods
Re: snort woes Jed Pickel
Re: snort woes Jim Starke
Re: snort woes (update) Jim Starke
RE: snort woes (update) John Berkers
RE: snort woes (update) John Berkers
Re: snort woes (update) Jim Starke
RE: spp_http_decode rules John Berkers
snort2bb script Jim Hankins
RE: spp_http_decode rules Erickson Brent W KPWA
Re: spp_http_decode rules Erek Adams

Sunday, 12 August

Flex Resp Larry E. Smith Jr.
(no subject) Erik
New to Snort Babajide Ibiayo
AW: Snort service stop Pesek Wolfgang (Mail)
snort1.8p + dynamic ip address Marcus Henschel
Re: snort1.8p + dynamic ip address "s10"
Re: snort1.8p + dynamic ip address John Sage
Changing the perms on the PID file Dan Cuthbert
Acid problems (cvsupped 11-08-01) Mark Rowlands
Re: Changing the perms on the PID file Avleen Vig
Re: IIS Unicode attack detected Andrew Daviel
snort_stat.pl version 1.15.2.3 parsing problem Kari Suomela
Snort-1.8.1-rc1 available Martin Roesch

Monday, 13 August

full tcpdump logging with alerting Ryan . Oliver
full tcpdump logging with alerts Ryan . Oliver
Flex-response & CodeRed Mark Wiater
Problems making on a Cobalt Qube2 Glen Scott
RE: IIS Unicode attack detected John Berkers
Re: full tcpdump logging with alerting Chris Green
Re: full tcpdump logging with alerting Martin Roesch
Re: full tcpdump logging with alerting Martin Roesch
Re: Problems making on a Cobalt Qube2 Jason A. Haynes
Re: Snort-1.8.1-rc1 available Ramin Alidousti
New FAQ in cvs.... Dragos Ruiu
ACID error Pär Thoren
Re: ACID error roman
RE: RE: FAQ 10/100 Hubs Block Other Speed Traffic (was: RE: [Snort-users] External snort monitoring) roman
another stupid noobie question... Dominick, David
Re: Acid problems (cvsupped 11-08-01) roman
Log entry question Chris Mason
pif WORM? john . ruff
Re: Flex Resp Neil Dickey
RE: pif WORM? Anthony Geoffron
Snort-1.8.1-rc2 released Martin Roesch
Re: another stupid noobie question... Martin Roesch
RE: snort-1.8.1-beta7 available Mayers, Philip J
Re: snort-1.8.1-beta7 available Martin Roesch
Re: pif WORM? Mike Baptiste
RE: pif WORM? Hawrylkiw, Dan G
RE: pif WORM? Hawrylkiw, Dan G
Partial IP searching with ACID? Kevin Brown
Compile problems Matt Miller
Help with setting up snort in "stealth mode" Michael Grenley
Re: Partial IP searching with ACID? Phil Wood
What's going on here? Mstream analysis... JSeddon
What's going on? Mstream analysis... JSeddon
Snort stops mysteriously Steven
RE: Snort stops mysteriously Martijn Heemels
RE: Snort stops mysteriously Steven
Re: Snort stops mysteriously Martin Roesch
Snort stops mysteriously Kari Suomela
RE: Help with setting up snort in "stealth mode" Jean-Pierre Harvey
X White Paper Released Ofir Arkin
X White Paper Released Ofir Arkin
Re: What's going on here? Mstream analysis... Phil Wood
Snort-Bug in Samba-Logging Thorsten Sauter

Tuesday, 14 August

Re: Snort stops mysteriously Pontus Joakimsson
Re: full tcpdump logging with alerting Ryan . Oliver
Re: ACID error Pär Thoren
Re: Snort stops mysteriously J. C. Woods
More on home_net and external_net Gisli Helgason
logging to mysql only. ACID - just my $.02 Zilvinas Atkociunas
Re: Compile problems Dragos Ruiu
Re: More on home_net and external_net Erek Adams
simple mistake? Chris Mason
Re: simple mistake? Erek Adams
RE: simple mistake? Cybulski, Vince
snort stopped logging alerts to secure Don Heffernan
RE: simple mistake? Chris Mason
RE: logging to mysql only. ACID - just my $.02 Cybulski, Vince
RE: More on home_net and external_net Gisli Helgason
RE: Partial IP searching with ACID? Kevin Brown
Coredumps from snort Suresh Rajagopalan
RE: More on home_net and external_net Erek Adams
Machine-readable stream4 stats Mayers, Philip J
Re: Coredumps from snort Martin Roesch
SNORT Mel Chandler PMI
Re: SNORT Erek Adams
Disabling OpenSsl Support in configure Patrick . Prue
Attempting to compile snort 1.8p1 on a cobalt box. Patrick . Prue
RE: More on home_net and external_net Kris Quinby
RE: SNORT Dan Fiorito
RE: SNORT Dr SuSE
snort and firewall Stephen Torri
Code Red III Tim Bogart
RE: Partial IP searching with ACID? Kevin Brown
Re: Code Red III Ryan Russell
snort "portscan.log" file empty? Matt Harrell
Snort-Bug in Samba-Logging Thorsten Sauter
FW: Latest NWC IDS article.... Chris Eidem
RE: Partial IP searching with ACID? roman
Re: Disabling OpenSsl Support in configure roman
Re: snort "portscan.log" file empty? Jason A. Haynes
Re: snort and firewall J. C. Woods

Wednesday, 15 August

Re: snort and firewall Stephen Torri
Re: snort and firewall John Sage
PC SNORT Katrina Sealey
Snort 1.8.1 released! Martin Roesch
Re: Disabling OpenSsl Support in configure Ben Hughes
Re: Snort 1.8.1 released! Jörgen Persson
Re: PC SNORT Jörgen Persson
Strange alert Ralf Hildebrandt
[announce] snort 1.8 debian packages Robert van der Meulen
Re: snort and firewall GeEk
Guardian 1.3.0 Steven
RE: snort "portscan.log" file empty? Matt Harrell
RE: PC SNORT Murphy
XML plugin Larry E. Smith Jr.
IDS553/web-iis_IIS ISAPI Overflow idq john . ruff
Re: IDS553/web-iis_IIS ISAPI Overflow idq Brian Caswell
Re: IDS553/web-iis_IIS ISAPI Overflow idq Dr SuSE
Re: [Snort-devel] Snort 1.8.1 released! Michael H. Warfield
portscan-ignoreports Jonathan J. Hart
Re: SNORT Phil Wood
Re: SNORT Brian Caswell
Re: [Snort-announce] Snort 1.8.1 released! Grant Bayley
snortdb / Oracle question big bob
Re: IDS553/web-iis_IIS ISAPI Overflow idq Ryan Russell
-i any problems Blake Frantz
RE: Coredumps from snort Suresh Rajagopalan
Rule for Morpheous yet? Tom Sevy
Portscan preprocessor catching DNS replies Mathieu Nantel
Re: Portscan preprocessor catching DNS replies Neil Dickey
SPADE question Neil Dickey
Re: Portscan preprocessor catching DNS replies Jörgen Persson
MISC source port 53 to <1024 Chris Mason
Snort v1.8 b7 Windows Problems Dennis Cooper
restart after updated rules? Chad Gough
Re: restart after updated rules? Neil Dickey
firewall and snort on the same machine Mohr, Stefan
Re: Snort v1.8 b7 Windows Problems Joe McAlerney
RE: Snort v1.8 b7 Windows Problems Frank Knobbe
Re: Snort 1.8.1 released! Jason Haar
RE: firewall and snort on the same machine John Berkers
Re: Portscan preprocessor catching DNS replies Andreas Östling
Re: Portscan preprocessor catching DNS replies Jörgen Persson
checkpoint fw and snort Steve Moran
Re: Portscan preprocessor catching DNS replies Jörgen Persson
RE: firewall and snort on the same machine Martijn Heemels
Snort 1.8.1 * RELEASE * Windows Binaries Available Michael Steele
RE: Re: [Snort-announce] Snort 1.8.1 released! Skeeve Stevens
RE: checkpoint fw and snort Frank Knobbe
New feature request Steve Hutchins
Re: New feature request Dragos Ruiu
Re: IDS: RE: Re: [Snort-announce] Snort 1.8.1 released! Dragos Ruiu
make problem admin
Limit on variable length? Nare Do Well
RE: New feature request Steve Hutchins
RE: firewall and snort on the same machine Dragos Ruiu
RE: New feature request Dragos Ruiu
Re: SPADE question Ralf Hildebrandt

Thursday, 16 August

RE: firewall and snort on the same machine John Berkers
Re: checkpoint fw and snort cm
question about flexresp snort plugin on openbsd Malikai
Snort and encrypted protocols Renaud Lemble
Re: Snort and encrypted protocols Marsiske Stefan
Re: Snort and encrypted protocols Renaud Lemble
please help me asap madhuri dixit
Re: Re: Snort and encrypted protocols Marsiske Stefan
AW: please help me asap Pesek Wolfgang (Mail)
RE: please help me asap John Berkers
Snort Installation issues! Missaghi, Shawn
refresh of tools Angelos Karageorgiou
Instructions using SNort with MySql And ACID On Linux Scott Pham
Re: Portscan preprocessor catching DNS replies root
Re: Rule for Morpheous yet? Erek Adams
Re: Snort Installation issues! Erek Adams
Re: Portscan preprocessor catching DNS replies Jörgen Persson
RE: New feature request Burleson, Lee (IA)
A new variation of CodeRed??????????? John Davey
make fails Jim Rauser
RE: Snort Installation issues! Erek Adams
libntp Bryan Childs
Re: libntp Erek Adams
Re: question about flexresp snort plugin on openbsd Neil Dickey
Re: A new variation of CodeRed??????????? Neil Dickey
Can you help me figure out what's happening here? Barton Hodges
RE: A new variation of CodeRed??????????? John Davey
Re: Rule for Morpheous yet? Phil Wood
MD5 sums for each CodeRed version (was "A new variation of CodeRed???????????") Stephen W. Thompson
Win 32 Snort 1.8.1 Release Problems With the Z Switch Erickson Brent W KPWA
Postgresql plug-in benchmarks Seth Leger
RE: Instructions using SNort with MySql And ACID On Linux Karl Lovink
RE: MD5 sums for each CodeRed version auto241065
RE: please help me asap Michael Steele
SeolMa auto241065
RE: snort -s and -l at the same time? Sven Olensky
Re: snort -s and -l at the same time? Joe McAlerney
Re: libntp Joe McAlerney
Acid and oracle or Demarc and oracle??? Mads Rasmussen
RE: MD5 sums for each CodeRed version Ryan Russell
Where do these rules come from? Steve Halligan
RE: A new variation of CodeRed??????????? Neil Dickey
Re: Where do these rules come from? Wesley Eddy
RE: Where do these rules come from? Steve Halligan
Re: question about flexresp snort plugin on openbsd Malikai
RE: Where do these rules come from? Steve Halligan
RE: New feature request Dragos Ruiu
Re: make fails Dragos Ruiu
Snort Article at LinuxJournal.com Jason Lewis
Re: Postgresql plug-in benchmarks Dragos Ruiu
starting acid Birkir Björnsson
(no subject) Bill Rogers
Re: Snort 1.8.1 released! Martin Roesch
dsniff signatures Jim Hankins

Friday, 17 August

ping flood Avi Norowitz
Snort OPSEC plugin for Check Point firewalls Chauvin Marc
password sniffingj Tracy R Reed
RE: (no subject) Bill Rogers
AW: password sniffingj Javier Vazquez
Snort New Feature Request Renaud Lemble
Re: password sniffingj Pär Thoren
RE: ping flood Ofir Arkin
Question re: FAQ 3.5.... Bob Hillegas
FW: password sniffingj Sutton, Andrew
Re: Question re: FAQ 3.5.... Mike Baptiste
Re: Snort-users digest, Vol 1 #939 - 13 msgs Bob Hillegas
RE: password sniffingj Dell, Jeffrey
Re: password sniffingj Michael Boman
Re: Question re: FAQ 3.5.... Bob Hillegas
Authenticating,Encrypting snort sensor traffic to the remote database Sean Wheeler
Re: Snort New Feature Request Martin Roesch
Snort 1.8.1 and AXP (Alpha) based Linux. Carl C.
Re: FW: password sniffingj Neil Dickey
RE: Snort 1.8.1 and AXP (Alpha) based Linux. Mayers, Philip J
preprocessor stream4 Scott Pham
Auto email and paging notifcation Scott Pham
ERROR: Unable to load graphing library Scott Pham
Re: preprocessor stream4 Neil Dickey
Re: Auto email and paging notifcation Erek Adams
Re: Snort 1.8.1 and AXP (Alpha) based Linux. Carl C.
Snort 1.8 release install question Darren
(more on) Snort 1.8 release install question Darren
Alot of retransmission alerts - What can it be???? Mads Rasmussen
Re: ping flood Avi Norowitz
Re: ping flood Chris Green
snort and VLANs Mohr, Stefan
RE: snort and VLANs Jason Long
Re: snort and VLANs Joshua Stein
RE: snort and VLANs MarcT
Rules Scott Pham
Re: Rules Neil Dickey
Re: Rules Dragos Ruiu
RE: Rules Ofir Arkin
RE: ping flood Ofir Arkin
Re: Auto email and paging notifcation homega
Re: dsniff signatures Jim Hankins
DB Rules Charles Henrich
Re: dsniff signatures patrick.n.fitzgerald.1
Re: DB Rules Erek Adams
snort 1.7/ACID logging to MYSQL, but no signatures showing Keith & Rachel Murphy
Re: DB Rules Charles Henrich
Re: DB Rules Chris Green
Re: Snort 1.8.1 and AXP (Alpha) based Linux. Martin Roesch
Re: DB Rules Erek Adams
[snort-users] Snort dying Kari Suomela
bad version number in snort.conf comments Phil

Saturday, 18 August

Limiting false-hits with "SMTP RCPT TO overflow" rule Jason Haar
Re: Authenticating,Encrypting snort sensor traffic to the remote database Jason Haar
Re: Re: Snort New Feature Request Jason Haar
Any examples of logging via dynamic rules out there? Jason Haar
RE: DB Rules Tom Sevy
Re: Any examples of logging via dynamic rules out there? Martin Roesch
Multiple IF Andrew Stubbs
Re: DB Rules Chris Green
acid - newbie Birkir Björnsson
Re: Multiple IF Jason Costomiris
Re: Multiple IF Erek Adams
Re: Log questions Phil
Re: DB Rules Mike Baptiste
Spade version 010818.1 available James Hoagland
Re: SeolMa Dragos Ruiu
RE: Multiple IF Tom Sevy
Announcement: Snort + FW-1 = SnortSam ... Now available Frank Knobbe
Re: Log questions Martin Roesch
Re: ping flood Avi Norowitz
Snort with Mysql Suchun Wu
SIGUSR1 and stats Jonathan J. Hart
Re: Snort 1.8.1 released! John Sage
Re: Snort 1.8.1 released! Brian Caswell
Re: Snort 1.8.1 released! John Sage
Re: Snort 1.8.1 released! [Snort-users] Stephen W. Thompson
Re: Snort 1.8.1 released! [Snort-users] John Sage
RE: Snort 1.8.1 released! Jason Lewis
Re: Re: Snort 1.8.1 released! [Snort-users] Michael Boman
Re: Multiple IF Phil Wood
Re: Snort 1.8.1 released! John Sage
Re: Snort 1.8.1 released! John Sage

Sunday, 19 August

snort in non switched environments Prashant Desai
Brazilian Snort List Alex Pinheiro Machado Rodrigues
Re: SNMP for Snort Glenn Mansfield Keeni
snort rules / arachnids Jason Long
Re: snort rules / arachnids Erek Adams
Announcement: Snort + FW-1 = SnortSam ... Now available Frank Knobbe
Re: snort in non switched environments Michael Boman
Re: Re: Snort 1.8.1 released! [Snort-users] Martin Roesch
Re: Snort with Mysql roman
Re: ERROR: Unable to load graphing library roman
Re: snort 1.7/ACID logging to MYSQL, but no signatures showing roman
Re: snort 1.7/ACID logging to MYSQL, but no signatures showing Keith & Rachel Murphy
Relationship between snort and ipchains and security strategies Steven
Snort2html update coming soon.... Daniel Swan
No logging Kari Suomela
[slightly ot] possible buffer overflow Jörgen Persson
Re: DB Rules Jason Robertson
Re: [slightly ot] possible buffer overflow Jörgen Persson
Problems with snort and syslogD Justin Tabish
Re: Relationship between snort and ipchains and security strategies John Sage
RE: Relationship between snort and ipchains and sec urity strategies Frank Knobbe
Re: DB Rules Erek Adams
Problems setting up... Justin Tabish

Monday, 20 August

Change Request - Additional Options and a better presentation layer for the ICMP prtocol Ofir Arkin
Firewall stopping detection? David Findlay
RE: Relationship between snort and ipchains and security strategies John Berkers
Core dump Mayers, Philip J
Re: Firewall stopping detection? Matthew Collins
re: ICMP flood detection? rottz
Possible scr worm john . ruff
Re: Possible scr worm Erek Adams
Re: Possible scr worm rottz
Blocking Portscans Justin Tabish
Possible scr worm john . ruff
spp_stream4: Possible RETRANSMISSION detection Mads Rasmussen
Re: spp_stream4: Possible RETRANSMISSION detection Erek Adams
Question about Acid Mike Shaw
Re: Question about Acid Mike Shaw
Browsing Whitehats Mads Rasmussen
Re: Browsing Whitehats rottz
Re: Browsing Whitehats Mike Baptiste
Understanding IDSkeys - thought I had it but no.......... Mads Rasmussen
Re: Understanding IDSkeys - thought I had it but no.......... Erek Adams
Re: Firewall stopping detection? John Sage
RE: Understanding IDSkeys - thought I had it but no .......... Dell, Jeffrey
Re: Understanding IDSkeys - thought I had it but no.......... Jörgen Persson
Re: DB Rules Jason Robertson
Re: Understanding IDSkeys - thought I had it but no .......... Mads Rasmussen
Re: Question about Acid roman
Re: spp_stream4: Possible RETRANSMISSION detection Mads Rasmussen
newbie questions Shcherbina, Andrey
Re: Firewall stopping detection? J. C. Woods
OT - CodeRed bthaler
Re: OT - CodeRed Ryan Russell
Re: spp_stream4: Possible RETRANSMISSION detection Mads Rasmussen
Re: was: spp_stream4: Now: ports database? John Sage
Re: was: spp_stream4: Now: ports database? Brian Caswell
Question on snort, displaying payload, and SnortSnarf Sean O'Neill
RE: Change Request - Additional Options and better presentation layer for the ICMP prtocol auto241065
Intrusion Testing Justin Tabish
Re: Snort with Mysql Joe McAlerney
Snort Compiling with mysql support JSeddon
Question about output syntax... Bob Hillegas
Re: Question about Acid Mike Shaw
please help me...(asap) madhuri dixit
Re: spp_stream4: Possible RETRANSMISSION detection Erek Adams
Re: Snort-users digest, Vol 1 #951 - 16 msgs Mike Klinke
Re: was: ppp_stream4 Now: ports again John Sage

Tuesday, 21 August

Re: Possible scr worm Matthew Collins
RE: please help me...(asap) Erwin
EXTERNAL_NET var acting strange Scott Nursten
Re: EXTERNAL_NET var acting strange Florent
Acid Alert Cache Auto update gerhard
Re: EXTERNAL_NET var acting strange Scott Nursten
Re: EXTERNAL_NET var acting strange Scott Nursten
Re: EXTERNAL_NET var acting strange Florent
Re: EXTERNAL_NET var acting strange Florent
RE: Question about Acid James Friesen
Re: EXTERNAL_NET var acting strange John Sage
Re: Possible scr worm john . ruff
Re: EXTERNAL_NET var acting strange Scott Nursten
Re: EXTERNAL_NET var acting strange Scott Nursten
Re: EXTERNAL_NET var acting strange Florent
RE: Question about Acid Michael Steele
Problem running snort 1_8 as an NY Win2KSrv Service Wayne Work
RE: Acid Alert Cache Auto update Michael Steele
Re: Possible scr worm Matthew Collins
snort rpms gone? Martijn Heemels
list archives... pbsarnac
Wish list... Bob Hillegas
Port Lookup Page dissapeared ? Tudor Panaitescu
1.8 on WinNT Question??? Ben Johansen
Re: Intrusion Testing Steve Shockley
Problem running snort 1_8 as an NY Win2KSrv Service Murphy
Re: Port Lookup Page dissapeared ? Mads Rasmussen
Re: Intrusion Testing J. C. Woods
Re: Possible scr worm John Sage
compiling 1.8.1 on a SuSE v7.2 box geoffrey
Answered my own question, but ... geoffrey
Snort and alert file Justin Tabish
Re: Port Lookup Page dissapeared ? john . ruff
Multiple CONTENT: rule Ben Johansen
Re: Answered my own question, but ... Joe McAlerney
SnortSnarf version 010821.1 James Hoagland
logging entire sessions Avleen Vig
Re: Problem running snort 1_8 as an NY Win2KSrv Service JP
RE:1.8 on WinNT Question??? Ben Johansen
RE: Wish list... Hawrylkiw, Dan G
RE: Multiple CONTENT: rule Frank Knobbe
Re: Port Lookup Page dissapeared ? John Sage
Snort and alert file Kari Suomela
Re: logging entire sessions Erek Adams
Logging Kari Suomela
Re: logging entire sessions Chris Green
ports database back online Brian Caswell

Wednesday, 22 August

RE: Problem running snort 1_8 as an NY Win2KSrv Service Michael Steele
RE: 1.8 on WinNT Question??? Michael Steele
Snort and memory Marcin Zurakowski
RE: 1.8 on WinNT Question??? Bojo
RE: logging entire sessions gary . smith
Re: Snort and memory John Sage
snort+guardian question Justin Tabish
Re: Intrusion Testing Matthew Collins
pif worm Bastian Ballmann
Re: compiling 1.8.1 on a SuSE v7.2 box Andreas Hasenack
CodeRedII again? Pontus Joakimsson
./Configure wierdness (1.8.1-RELEASE) Michael Boman
Compiling 1.8.1 with postgres support - failed Mads Rasmussen
Re: Snort and memory Martin Roesch
Can you help me figure out what's happening here? Barton Hodges
Re: Compiling 1.8.1 with postgres support - failed Kiira Triea
1.7 and MySQL bthaler
Re: Snort and memory Marcin Zurakowski
Re: Snort and memory Martin Roesch
Re: Snort and memory John Sage
Re: Acid Alert Cache Auto update roman
Re: 1.7 and MySQL roman
Snort + Daemontools document??? Subba Rao
Re: 1.7 and MySQL bthaler
Variable john . ruff
Re: Snort + Daemontools document??? Marsiske Stefan
Re: CodeRedII again? Ryan Russell
Re: 1.7 and MySQL roman
Snort refuses to compile with mysql support, but seems to... JSeddon
Re: 1.7 and MySQL bthaler
Re: Snort + Daemontools document??? Jörgen Persson
Re: Snort refuses to compile with mysql support, but seems to... roman
Re: Snort + Daemontools document??? Subba Rao
can't compile Kirit Patel (CTG)
Re: Variable Erek Adams
Re: CodeRedII again? Skip Carter
Re: Variable Erek Adams
Re: Snort refuses to compile with mysql support, but seems to... Matthew Collins
Re: Compiling 1.8.1 with postgres support - failed Mads Rasmussen
Re: Variable john . ruff
Re: list archives... Max Valdez
Re: Variable Erek Adams
ACID failes to delete alerts Mads Rasmussen
DNS server receiving NMAP scans john . ruff
Re: Snort refuses to compile with mysql support, but seems to... JSeddon
Re: [Snort-devel] ./Configure wierdness (1.8.1-RELEASE) Joe McAlerney
Re: ACID failes to delete alerts roman
Firewall Rich Phelps
Snort sniffing (snorfing?) Wedge Breaker
Re: Snort sniffing (snorfing?) Erek Adams
database IP attribute logging format Jamil Farshchi
Re: Snort 1.8.1 released! Chris Adams
Re: Problem running snort 1_8 as an NY Win2KSrv Service JP
Re: database IP attribute logging format Ramin Alidousti
Re: pif worm Mike Klinke
Re: Re: pif worm pbsarnac
adding other alert types to the ACID db bretwatson
Re: Snort 1.8.1 released! John Sage
CVE site not responding? Ben Johansen
Re: Snort 1.8.1 released! Erek Adams

Thursday, 23 August

Re: Any examples of logging via dynamic rules out there? Jason Haar
Re: Any examples of logging via dynamic rules out there? Jason Haar
RE: database IP attribute logging format Mayers, Philip J
Re: Snort 1.8.1 released! Mike Baptiste
how to notify via external utilities? Dmitry Komarov
running snort with daemontools Javier Vazquez
getting started how to ..help brentb
RE: Re: pif worm James Friesen
Re: getting started how to ..help Michael Boman
Re: Re: pif worm Brian Caswell
RE: Re: pif worm James Friesen
How can I tell if spade is running? Matthew Collins
Blackbox setup - Keyboard and Mouse Subba Rao
Re: Snort 1.8.1 released! Phil Wood
Re: Re: pif worm Jim Forster
RE: getting started how to ..help Erwin
Re: getting started how to ..help Erek Adams
RE: getting started how to ..help Mike Shaw
Re: Blackbox setup - Keyboard and Mouse Ramin Alidousti
RE: Snort sniffing (snorfing?) Wedge Breaker
RE: Snort sniffing (snorfing?) Erek Adams
Seg Fault on Snort with MySQL on Redhat 7.0 Baker, J
SeowWee/SNS is out of the office. SeowWee
bogus buffer length Marcelo Gulin
Beginner w/ IDS and snort Snail945
Re: Seg Fault on Snort with MySQL on Redhat 7.0 roman
Re: Beginner w/ IDS and snort Wesley Eddy
RE: Beginner w/ IDS and snort Steve Halligan
RE: Seg Fault on Snort with MySQL on Redhat 7.0 Baker, J
Re: Beginner w/ IDS and snort Erek Adams
Re: SeowWee/SNS is out of the office. Martin Roesch
Re: adding other alert types to the ACID db roman
RE: database IP attribute logging format Jamil Farshchi
ACID delete entry error Mads Rasmussen
Code Red on 98, 95 computers Missaghi, Shawn
Re: ACID delete entry error roman
Re: How can I tell if spade is running? Gary Grim
Snortsnarf sux, snort_stat rulez Sheahan, Paul (PCLN-NW)
perl scripts (*.pl) John Ruff
Re: Snortsnarf sux, snort_stat rulez Stuart Staniford
Re: Code Red on 98, 95 computers JP
Re: Beginner w/ IDS and snort JP
[Snort-User] Question about SUN SPARC Box install Version 8 Wayne T Work
Re: perl scripts (*.pl) Chris Green
Re: perl scripts (*.pl) John Ruff
Re: Code Red on 98, 95 computers Jason Haar
Re: Snortsnarf sux, snort_stat rulez Brian Caswell
Re: How can I tell if spade is running? James Hoagland
Re: Beginner w/ IDS and snort Snail945
Re: Snortsnarf sux, snort_stat rulez Yen-Ming Chen
Question concerning packet statistics... Bob Hillegas
1.8.1 not logging anything Phil

Friday, 24 August

Re[2]: [Snort-devel] IDS fingerprinting techniques & Snort's FlexR esponse... Dmitry Komarov
Bad int8 external representations (was: ACID delete entry error) Holger Krofczik
Bad int8 external representations (was: ACID delete entry error) Holger Krofczik
-b and -d command line arguments Jones, Benny
Re: How can I tell if spade is running? Matthew Collins
snortreport php error Jacob Killian
Re: [Snort-User] Question about SUN SPARC Box install Version 8 Erek Adams
Re: Beginner w/ IDS and snort Daniel Voyer
Snort not logging to syslog. Liam burke
RE: [Snort-User] Question about SUN SPARC Box insta ll Version 8 Kevin Brown
Snort 1.8.1 Win32 MSSQL Burleson, Lee (IA)
RE: Re: Snortsnarf sux, snort_stat rulez Sheahan, Paul (PCLN-NW)
Re: Beginner w/ IDS and snort Mark Rowlands
Re: Snort 1.8.1 Win32 MSSQL Chris Reid
Re: snortreport php error (RESOLVED) Jacob Killian
snort new ruleset and vision rules Liam burke
RE: Snort 1.8.1 Win32 MSSQL Burleson, Lee (IA)
Re: snort new ruleset and vision rules Michael Boman
RE: snort new ruleset and vision rules Liam burke
RE: snort new ruleset and vision rules Jason Long
RE: snort new ruleset and vision rules william . c . gercken
SMB Alerts w/MySQL Paul D. Shaffer
Question on particular port scan of port 139/TCP Sean O'Neill
Re: SMB Alerts w/MySQL Kevin Pietersma
RE: SMB Alerts w/MySQL Paul D. Shaffer
RE: SMB Alerts w/MySQL Kevin Pietersma
(no subject) Patrick W Bass
Ipchains questions Darrin Powell
Re: Ipchains questions Blake Frantz
Re: Question on particular port scan of port 139/TCP J. C. Woods
Re: RE: SMB Alerts w/MySQL Phil Wood
Flexresp? Ben Johansen
Re: snort new ruleset and vision rules Michael Boman
Barnyard Jason Lewis
redesigning snort swag al3x payne
Re: Barnyard Martin Roesch
RE: Blackbox setup - Keyboard and Mouse Jason Lewis
Re: Question on particular port scan of port 139/TCP Sean O'Neill

Saturday, 25 August

ICMP Destination Unreachable (Communication Administratively Prohibited) Dushyanth Harinath
RE: ICMP Destination Unreachable (Communication Administratively Prohibited) Ofir Arkin
RE: ICMP Destination Unreachable (Communication Administratively Prohibited) Dushyanth Harinath
RE: ICMP Destination Unreachable (Communication Administratively Prohibited) Ofir Arkin
1.8.1 rpm? Chris Mason
Re: redesigning snort swag Dr SuSE
Re: redesigning snort swag Glenn Huish
strange logging Guido Dolci
Effective Snort Design Methodologies roger clemens
RE: Effective Snort Design Methodologies Ace
RE: Effective Snort Design Methodologies Kohlenberg, Toby
Revised SnortSam Frank Knobbe
RE: strange logging John Berkers

Sunday, 26 August

Snort 1.8.1 WIN32 MSSQL John Kirk
Snort Report 1.05 Released David Gullett
Can we get snort to differentiate between client and server? Jason Haar
Possible Retrans & Evasive RST's Sheahan, Paul (PCLN-NW)
Parsing snort alerts? Daniel Swan
Upgrading to Snort 1.8.1 Win32 - any mySQL changes necessary? John Hall
(no subject) John
Re: Upgrading to Snort 1.8.1 Win32 - any mySQL changes necessary? Michael Boman

Monday, 27 August

core dump problem. g . carabetta
Logging problem Dushyanth Harinath
Missing Packet Logs marco
Re: Code Red on 98, 95 computers Frontgate Lab
Re: Possible Retrans & Evasive RST's Erek Adams
Re: Parsing snort alerts? Erek Adams
Re: Ipchains questions Darrin Powell
Kernel compile options for OpenBSD Chris Eidem
Upgrading snort? Chris Eidem
Re: Code Red on 98, 95 computers John Sage
RE: Ipchains questions Ciaron Gogarty
acid errors Steve Moran
Re: Kernel compile options for OpenBSD al3x payne
RE: acid errors Steve Halligan
RE: Code Red on 98, 95 computers Ciaron Gogarty
RE: acid errors Steve Moran
General snort problem V.
General snort problem V.
General snort problem V.
read-only cable Daniel Voyer
General snort problem V.
Re: General snort problem Michael 'Moose' Dinn
Re: General snort problem V.
Re: Ipchains questions Blake Frantz
Demarc Missaghi, Shawn
Re: General snort problem Erek Adams
RE: acid errors roman
Stealth Robledo
Re: General snort problem V.
RE: Demarc Jason Long
Re: Logging problem Joe McAlerney
Re: read-only cable Joe McAlerney
Snort as a service in W2k Steve Moran
RE: Snort as a service in W2k Johnson, David
RE: Snort as a service in W2k Steve Moran
RE: Snort as a service in W2k Johnson, David
FAQ-type Q plus FAQ patch Jason A. Haynes
Snort Question Bill Rogers
Re: Stealth JP
Re: Snort Question Chris Green
RE: Snort Question Kresna Prawira
Something I don't understand... Bob Hillegas
HOME_NET and DNS Taisto Qvist

Tuesday, 28 August

Re: Snort 1.8.1 WIN32 MSSQL Chris Reid
RE: read-only cable Thomas Nilsen
report information bruno
Re: Snort and memory Scott Nursten
Re: General snort problem Daniel Voyer
Problems with Snort and MySql Mendoza, Luis
data in tcp syn packet alert Jones, Benny
Re: Ipchains questions Darrin Powell
RE: Snort as a service in W2k Steve Moran
RE: Problems with Snort and MySql Steve Halligan
Re: How can I tell if spade is running? James Hoagland
RE: Ipchains questions Mayers, Philip J
snort website Jason Smith
RE: Problems with Snort and MySql Mendoza, Luis
Re: Ipchains questions Borja Marcos
RE: snort website Liam burke
Re: Something I don't understand... John Sage
Re: snort website Brian Caswell
Snort and the Telnet Preprocessor Liam burke
Is anyone Using FLEXRESP? Ben Johansen
Re: Something I don't understand... Bob Hillegas
flexresp Ramin Alidousti
WEB-IIS Unauthorized IP Access Attempt Ronny Huybrechts @ Pandora
Re: Ipchains questions Darrin Powell
Re: Something I don't understand... John Sage
Oracle Support Melvin Robinson
Re: Something I don't understand... Bob Hillegas
RH7.1 Rich Phelps
RE: flexresp Neal Timm
Snort Documentation Ingersoll, Jared
Re: RH7.1 GeEk
Re: Snort Documentation John Sage
Off topic ids-lists
Re: Snort Documentation Brian Caswell
RH7.1 Kari Suomela
Re: Snort and memory Martin Roesch
Re: Snort and the Telnet Preprocessor Chris Green
Where to get " code red worm source" ? ls1100
RE:Snort-users -- confirmation of subscription -- request 417855 jibiland

Wednesday, 29 August

Re: Log questions Phil
HOST exclusion Invernizzi Fabrizio
Re: How can I tell if spade is running? Matthew Collins
FW: Where to get " code red worm source" ? Martin O'Reilly
Shadow IDS 1.0 Guy Bruneau
snort-win2k-serial Sherif El-Kassas
RE: Snort and memory Mayers, Philip J
Re: Log questions Martin Roesch
Re: How can I tell if spade is running? James Hoagland
snort on nt 4.0 Schmeits, Roger
Re: Off topic Jensenne Roculan
RE: snort on nt 4.0 Johnson, David
Re: snort on nt 4.0 Joe McAlerney
Re: Where to get " code red worm source" ? Phil Wood
Report to Recipient(s) LINTNG6
Bericht an Empfänger smnotes1/sm1/de%SIEB-MEYER
Antigen found CodeRed.C.Worm virus ANTIGEN_CYAN5
snortreport -- SLOOOW Jacob Killian
Antigen found W32/Codered-II (Sophos) virus ANTIGEN_PBA_SERVER1
virus Mads Rasmussen
RE: snort on nt 4.0 Dave Elfering
RE: virus Steve Halligan
Re: snortreport -- SLOOOW Jason Costomiris
Boy, I'm in trouble now... Phil Wood
Antigen found W32/Codered-II (Sophos,CA(Vet)) virus ANTIGEN_ISCNT-05
Re: Where to get " code red worm source" ? Daniel Monjar
Re: Off topic Martin Roesch
Trouble compiling snort --with-snmp Chris Eidem
snort not logging to both syslog and specified log directory M Venkatesh
Re: snortreport -- SLOOOW Jacob Killian
snortreport -- SLOOOW Kari Suomela
Re: snortreport -- SLOOOW Jason Costomiris
Re: snortreport -- SLOOOW Jacob Killian
Libpcap library/headers not found... Beckster
Re: Where to get " code red worm source" ? Phil Wood
RE: Libpcap library/headers not found... Neal Timm
Antigen found W32/Codered-II (Sophos,CA(Vet)) virus ANTIGEN_ISCNT-05
New Version Neal Timm
Antigen found W32/Codered-II (Sophos,CA(Vet)) virus ANTIGEN_ISCNT-05
Report to Recipient(s) LINTNG6
Antigen found W32/Codered-II (Sophos) virus ANTIGEN_PBA_SERVER1
Antigen found W32/Codered-II (Sophos) virus ANTIGEN_PBA_SERVER1
Snorting to logs, Winpopup and Syslog simultaneously Shankar Ramchandran
Bericht an Empfänger smnotes1/sm1/de%SIEB-MEYER
Daemon mode Anupam Bansal
ICMP L3retriever Ping? Barton Hodges
Re: Log questions Phil
i can't build snort source code with mysql 3.23.40 cwinl

Thursday, 30 August

Strange happenings over NVP Ryan . Oliver
RE: ICMP L3retriever Ping? Joshua Wright
sircam removal Chris Mason
Re: sircam removal Michael Boman
Re: Boy, I'm in trouble now... Martin Roesch
Re: sircam removal JP
Re: sircam removal Ralf Hildebrandt
Re: sircam removal Florent
Re: Boy, I'm in trouble now... Dan Cuthbert
RE: snortreport -- SLOOOW John Berkers
RE: Daemon mode John Berkers
Re: sircam removal Florent
RE: sircam removal Graeme Fowler
Re: sircam removal Ralf Hildebrandt
Re: Daemon mode Byron York
Re: Daemon mode Florent
RE: ICMP L3retriever Ping? John Berkers
RE: sircam removal Erek Adams
Help! Snort is not... snorting!!! g . carabetta
Re: ICMP L3retriever Ping? Chris Keladis
RE: Snort 1.8.1 WIN32 MSSQL John Kirk
[Fwd: ICMP L3retriever Ping?] Chris Keladis
Hardening the snort W2K Box inside DMZ. Boisvert, Mario
RE: Hardening the snort W2K Box inside DMZ. Tom Sevy
Installing Libpcap on RedHat 7.1 T.Ferris
Re: [Fwd: ICMP L3retriever Ping?] Beckster
Re: Installing Libpcap on RedHat 7.1 Beckster
RE: Where to get " code red worm source" ? Mel Chandler PMI
Re: Installing Libpcap on RedHat 7.1 Peter Bates
Portscan.log ids-lists
Re: Where to get " code red worm source" ? Phil Wood
RE: i can't build snort source code with mysql 3.23.40 Robert Sorensen
Re: Where to get " code red worm source" ? Ryan Russell
Re: Installing Libpcap on RedHat 7.1 Tim Bogart
Re: Installing Libpcap on RedHat 7.1 Beckster
Re: Installing Libpcap on RedHat 7.1 Erek Adams
Re: Where to get " code red worm source" ? Olaf Schreck
RE: snortreport -- SLOOOW Kevin Brown
Re: Daemon mode pbsarnac
Informal survey reveals anti-email-virus popularity Phil Wood
Test - Ignore Snort-users
spp_http_decode: IIS Unicode attack detected Steve Moran
Re: spp_http_decode: IIS Unicode attack detected Andrew . Hutchinson
RE: spp_http_decode: IIS Unicode attack detected Ben Johansen
FlexResp Running (I THINK!) Ben Johansen
Re: FlexResp Running (I THINK!) Joe McAlerney
Re: FlexResp Running (I THINK!) Ben Johansen
Re: FlexResp Running (I THINK!) Skip Carter

Friday, 31 August

RE: snortreport -- SLOOOW -- ACID, NOT! Jacob Killian
RE: FlexResp Running (I THINK!) Burleson, Lee (IA)
Re: Corrupt binaries in CVS (was: Snort 1.8.1 WIN32 MSSQL) Chris Reid
Re: [Fwd: ICMP L3retriever Ping?] Chris Keladis
What machine is that... Anyway? JC Rodz
Re: sircam removal Jason Haar
Re: What machine is that... Anyway? Jim Zajkowski
detecting Portscans Neal Timm
Re: Libpcap library/headers not found... John Sage
dazed and confused Linux0wnz
RE: FlexResp Running (I THINK!) Michael Davis
RE: Help! Snort is not... snorting!!! Neal Timm
Updated Win32 binaries Joe McAlerney
RE: FlexResp Running (I THINk!) Ben Johansen
Problem with version 1.8 on win 32 KOLADA ALEJANDRO
Re: spp_http_decode: IIS Unicode attack detected Olaf Schreck
FlexResp I THINK II (the sequel) Ben Johansen
Barnyard-0.1.0-beta2 available Martin Roesch
Re: hi ^^ I have question ^^ Phil Wood
RE: What machine is that... Anyway? Chris Eidem
Misc loopback traffic Michael J. Barillier
morpheus signature? Olensky, Sven
RE: detecting Portscans Neal Timm
Re: Misc loopback traffic J. C. Woods
Re: Corrupt binaries in CVS (was: Snort 1.8.1 WIN32 MSSQL) Olaf Schreck
log files Adriel Navarro
problem with database plug-in Oliver Skiebe
Snort 1.81-RELEASE, libnet 1.0.2a and FlexResp: not compiling Jyri Hovila
Re: Snort 1.81-RELEASE, libnet 1.0.2a and FlexResp: not compiling Skip Carter
Re: morpheus signature? Peter Bates
Re: log files Andrew R. Baker
logto: "/dev/null" Hammerle, Tye F

Saturday, 01 September

RE: Portscan.log John Berkers
RE: Installing Libpcap on RedHat 7.1 John Berkers
RE: problem with database plug-in John Berkers
Brackets around 1st varible in snort.conf Randy

Sunday, 02 September

Brackets around 1st varible in snort.conf Kari Suomela
Promiscuouls Mode Question Jim Kipp
Re: Promiscuouls Mode Question Erek Adams
Re: Promiscuouls Mode Question "s10"
Re: Promiscuouls Mode Question Jim Kipp
Re: Promiscuouls Mode Question Jim Kipp
Re: Brackets around 1st varible in snort.conf John Sage
Re: Brackets around 1st varible in snort.conf Erek Adams
Alert_unixsock Anupam Bansal
-A alert option Anupam Bansal
logging Neal Timm
Re: Snort 1.81-RELEASE, libnet 1.0.2a and FlexResp: not compiling Andreas Östling
Re: Brackets around 1st varible in snort.conf John Sage
precedence question al3x payne
Again, bBrackets around 1st varible in snort.conf Randy
Re: precedence question J. Craig Woods
Re: Promiscuouls Mode Question J. Craig Woods
Re: logging Jed Pickel

Monday, 03 September

MySQL Log rotate adrian.hobbs
Re: What machine is that... Anyway? Niek Jongerius
Re: Promiscuouls Mode Question Fyodor
Re: What machine is that... Anyway? Chris Adams
Re: What machine is that... Anyway? Fyodor
Re: Promiscuouls Mode Question Jim Kipp
snort 1.8.1 and vision18.rules and mysql Poppi, Sandro
RE: snort 1.8.1 and vision18.rules and mysql Jeff Dell
Re: Alert_unixsock Fyodor
Re: Again, bBrackets around 1st varible in snort.conf Erek Adams
AW: snort 1.8.1 and vision18.rules and mysql Poppi, Sandro
AW: (Snort-users) snort 1.8.1 and vision18.rules and mysql sandro.poppi
Stealth Interface on Win32 Platforms Archer

Tuesday, 04 September

AW: (Snort-users) snort 1.8.1 and vision18.rules and mysql sandro.poppi
Re: Stealth Interface on Win32 Platforms Erek Adams
reg SnortSam akshaye kalkura
RE: What machine is that... Anyway? Chris Eidem
RE: Stealth Interface on Win32 Platforms Frank Knobbe
RE: reg SnortSam Frank Knobbe
Snort Guide PDF Alex Pinheiro Machado Rodrigues
RE: Stealth Interface on Win32 Platforms Tom Sevy
Upgrading Snort 1.7 to 1.8.x Sheahan, Paul (PCLN-NW)
RE: Stealth Interface on Win32 Platforms Frank Knobbe
archiving mysql Jacob Killian
RE: Stealth Interface on Win32 Platforms Lucas Wharton
snort 1.8.1 with mysql support Peter Branch
Install errors ?? Tim
Re: archiving mysql roman
Re: Install errors ?? Erek Adams
my logs is flooding with snort w/ some weird message about port 53 alexus
Re: archiving mysql Jacob Killian
Re: Install errors ?? Peter Branch
snort on smp machine Alessandro Fiorenzi
Awesome !! Tim
RE: Stealth Interface on Win32 Platforms Burleson, Lee (IA)
Re: my logs is flooding with snort w/ some weird message about port 53 Ramin Alidousti
FW: Install errors ?? Hawrylkiw, Dan G
Re: my logs is flooding with snort w/ some weird message about port 53 alexus
Re: my logs is flooding with snort w/ some weird message about port 53 alexus
Re: my logs is flooding with snort w/ some weird message about port 53 Ramin Alidousti
Re: my logs is flooding with snort w/ some weird message about port 53 Ramin Alidousti
Re: my logs is flooding with snort w/ some weird message about port 53 alexus
Re: Alert_unixsock Fyodor
Re: Alert_unixsock Fyodor
Re: my logs is flooding with snort w/ some weird message about port 53 Martin Roesch
Can't get snort to compile with snmp. Matthew Schumacher
Re: my logs is flooding with snort w/ some weird message about port 53 alexus
compile help or Binaries/RPMs available? Travis Farmer
SNMP Output question. Vjay LaRosa
Re: Awesome !! Erek Adams
Re: Install errors ?? Erek Adams
usage Sloan Miller
(no subject) Sloan Miller
Re: (no subject) Jim Kipp
Re: (no subject) Erek Adams
Re: compile help or Binaries/RPMs available? Travis Farmer
Making snort go.... Travis Farmer
Re: Making snort go.... Erek Adams
AW: (Snort-users) Making snort go.... sandro.poppi
AW: (Snort-users) Upgrading Snort 1.7 to 1.8.x sandro.poppi
AW: (Snort-users) Snort Guide PDF sandro.poppi

Wednesday, 05 September

problem with installation Dariusz Zmokly
RE: SNMP Output question. Fraser Hugh
RE: archiving mysql Fraser Hugh
RE: Can we get snort to differentiate between clien t and server? Fraser Hugh
RE: Promiscuous Mode Nic drivers for 3com Klimarchuk John
Demarc with oracle - any chance? Mads Rasmussen
snort 1.8.1 coredumps on Solaris 2.6 Galappatti, Kishantha
RE: problem with installation Hawrylkiw, Dan G
Snort and SQL performance Kevin Brown
RE: Snort on Win32 platform Klimarchuk John
Re: Stealth Interface on Win32 Platforms Dragos Ruiu
Re: RE: Snort on Win32 platform roel
RE: Snort and SQL performance Fraser Hugh
Re: MySQL Log rotate David Gadbois
Limewire Joe Lawson
Re: Limewire rottz
rule sets on CVS Bob Van Cleef
Re: rule sets on CVS Ramin Alidousti
%u encoding Dragos Ruiu
Re: Limewire Stan Scalsky
%u and douglas adams Dragos Ruiu

Thursday, 06 September

Documentation. Vahid Shamai
Re: Documentation. Brian
AW: (Snort-users) Documentation. sandro.poppi
compiling snort with support for oracle Mads Rasmussen
Log analysis tools Subba Rao
AW: (Snort-users) Log analysis tools sandro.poppi
Re: (Snort-users) Log analysis tools Subba Rao
AW: (Snort-users) Log analysis tools sandro.poppi
[lee.brotherston () uk easynet net: ] leE
RE: Limewire James Friesen
Snort Docs Paul D. Shaffer
Re: Snort Docs Chris Green
Re: rule sets on CVS Andreas Östling
ACID Archiving on Postgresql leE
Re: rule sets on CVS Bob Van Cleef
Snort 1.8 RPM Mel Chandler PMI
Silcondefense.com Snort_1.8.b77_MSSQL_Binary Stephen Shepherd
CC DHB Secure Mail Server Notification Capital and Coast Information Security
RE: Snort and SQL performance Kevin Brown
RE: ACID Archiving on Postgresql Fraser Hugh
RE: Re: (Snort-users) Log analysis tools Fraser Hugh
Not ignoring DNS servers Paul Slinski
RE: Not ignoring DNS servers Snoopy
RE: Not ignoring DNS servers Paul Slinski
RE: Not ignoring DNS servers Paul Slinski
Re: Not ignoring DNS servers Italo Antonio
RE: Snort and SQL performance Kevin Brown
a quick redhat 7.1 snort/postgresql/acid install guide available Kelly Fallon
ACID mySQL Problems Rohrs, Ben
Re: Silcondefense.com Snort_1.8.b77_MSSQL_Binary Chris Reid
Re: ACID mySQL Problems roman
Testing snort Travis Farmer
Re: Testing snort Dragos Ruiu
Name of Vendor who makes passive ethernet or splitter tap Raymond Jacob
Re: Documentation. Dragos Ruiu
RE: Name of Vendor who makes passive ethernet or sp litter tap Kelly Fallon
RE: Name of Vendor who makes passive ethernet or sp litter tap Frank Knobbe
Acid time out errors with Win32 Lists
RE: Acid time out errors with Win32 Kresna Prawira
RE: Silcondefense.com Snort_1.8.b77_MSSQL_Binary Stephen Shepherd
RE: Acid time out errors with Win32 Lists
Snort On Windows - Major Announcement Michael Steele
RE: Snort On Windows - Major Announcement Frank Knobbe
Re: Documentation. Shaiful
Re: ACID Archiving on Postgresql leE
Receive only success/questions w
Re: Testing snort Nathan Carey
snort not logging meling
AW: (Snort-users) Snort 1.8 RPM sandro.poppi
Re: snort not logging Jed Pickel

Friday, 07 September

Re: snort not logging meling
Block packages Carlos Illana
Re: snort not logging meling
Re: Testing snort gary . smith
Memory usage on Snort Scott Nursten
NEW-CodeRed-Version Blue andreas
RE: Acid time out errors with Win32 bkippen
Usage stats. Vjay LaRosa
Re: Usage stats. Chris Green
Re: Usage stats. Niek Jongerius
Re: Snort On Windows - Major Announcement Michael Davis
RE: AW: (Snort-users) Log analysis tools Fraser Hugh
RE: Re: Testing snort ro0tw0rm
Snort -v tommy
Re: Memory usage on Snort Andrew R. Baker
Re: Snort -v Erek Adams
Re: ACID Archiving on Postgresql roman
portscan questions... Grimes, Shawn (NIA/IRP)
Re: portscan questions... roman
thing on the snort.org page??? Travis Farmer
Upgrade from 1.7 to 1.8? Thomas Porter, Ph.D.
Re: thing on the snort.org page??? Erek Adams
Re: Upgrade from 1.7 to 1.8? Erek Adams
I have problem for start snort 1.8 alko kola
Re: thing on the snort.org page??? Brian
Re: Usage stats. Brian
RE: Name of Vendor who makes passive ethernet or sp litter tap Raymond Jacob
snort on obsd performance skop d'skop
Re: snort on obsd performance Erek Adams

Saturday, 08 September

guardian + snort Dariusz Brzeziński
guardian + snort again Dariusz Brzeziński
RE: guardian + snort Jyri Hovila
Help needed -- trying to log to a mysql database Peter Borner
Re: Help needed -- trying to log to a mysql database Erek Adams
RE: guardian + snort Matt Bridges
traffic analysis Greg Sarsons
RE: guardian + snort again Neal Timm
(no subject) Kenneth Wells
removing alerts Travis Farmer
Re: (no subject) roman

Sunday, 09 September

OS Choice - No Flame War! gary . smith
Re: removing alerts John Sage
Re: Traffic Analysis gary . smith
Re: Re: Traffic Analysis Erek Adams
Re: OS Choice - No Flame War! Erek Adams
Re: snort on obsd performance Mike Poor
Little install dilemma Tim
RE: Little install dilemma Jason Lewis
snort + guardian Dariusz Brzeziński
RE: Little install dilemma Greg Herlein

Monday, 10 September

logging to both log file and database meling
AW: (Snort-users) logging to both log file and database sandro.poppi
Re: (Snort-users) logging to both log file and database meling
snort dying Neal Timm
RE: MySQL Log rotate Jyri Hovila
Re: Memory usage on Snort Scott Nursten
Re: snort dying Ralf Hildebrandt
predefined variables Nathan W. Labadie
Re: snort dying Erek Adams
RE: MySQL Log rotate roman
snort dying Dariusz Brzeziński
Re: snort dying Ralf Hildebrandt
HOME_NETS Robert Lister
RE: Usage stats. Dell, Jeffrey
RE: snort dying Fraser Hugh
Re: MySQL Log rotate David Gadbois
RE: MySQL Log rotate Jyri Hovila
FW: MySQL Log rotate Jyri Hovila
Re: Usage stats. John Sage
traffic analysis Dariusz Zmokly
RE: Usage stats. Dell, Jeffrey
Re: Snort On Windows - Major Announcement Joe McAlerney
Re: traffic analysis Italo Antonio
RE: traffic analysis Jyri Hovila
Re: Usage stats. John Sage
Re: snort dying Evan Carter
flexresp Ramin Alidousti
Re: traffic analysis David Gadbois
Re: snort dying Skip Carter
RE: Snort On Windows - Major Announcement Frank Knobbe
RE: snort dying Neal Timm
Negation while still using source ports. Vjay LaRosa
Re: Negation while still using source ports. Dragos Ruiu
Barnyard Larry E. Smith Jr.
Re: Negation while still using source ports. Phil Wood
Re: Negation while still using source ports. Erek Adams
Some flags in the pv structure in snort main Anupam Bansal
Re: Some flags in the pv structure in snort main Erek Adams
Re: Some flags in the pv structure in snort main Brian
Re: Barnyard Martin Roesch
AW: (Snort-users) snort dying sandro.poppi

Tuesday, 11 September

WHAT IT MEAN Alessandro Coppelli
Re: Usage stats. Matthew Collins
Re: WHAT IT MEAN Dan Cuthbert
Problem with libpq.so Bastian Ballmann
Help Craig Sweigart
anti-sniff mohamed maraikayar
SOT-Any signs of increased IDS today? Jacob Killian
Re: SOT-Any signs of increased IDS today? Gordon Ewasiuk
Best Wishes from the UK Tom Rowan
RE: SOT-Any signs of increased IDS today? Mark Spieth
Todays Terrorist Attack SecurityGauntlet
SNORT keywork to check TCP window size Alberto Grazi
dying Neal Timm

Wednesday, 12 September

Re: Dying Michael Schwartzkopff
Re: Re: Dying Jason Haar
Re: snort dying Ralf Hildebrandt
compile snort with mysql suport. Bruno Gimenes Pereti
AW: (Snort-users) compile snort with mysql suport. sandro.poppi
(no subject) Jim Rauser
RE: SNORT keywork to check TCP window size Alberto Grazi
Re: Todays Terrorist Attack Gordon Ewasiuk
Re: Todays Terrorist Attack Wayne T Work
Re: SNORT keywork to check TCP window size Phil Wood
FYI: a missing CAP Jose Celestino
ARP Spoofing and IP spoofing Wayne T Work
Re: Todays Terrorist Attack Ben N. Venzke
Snort and Snarf - Way Cool Bob
Document contains no data ACID+Snort Pritpal Bhogal
Fwd: Document contains no data ACID+Snort Pritpal Bhogal
Great book on IDS Mads Rasmussen
snort -dvr john . ruff
install problem Sheahan, Paul (PCLN-NW)
Re: install problem Gordon Ewasiuk
CVS Rule set problem - web-iis.rules Bob Van Cleef
Re: CVS Rule set problem - web-iis.rules Brian
Latest Snort build? Sheahan, Paul (PCLN-NW)
FreeBSD, IPFilter and Snort Andreas Brenk
Re: install problem Alex Pinheiro Machado Rodrigues
Some data structures in rules.h file Anupam Bansal
Re: Document contains no data ACID+Snort roman
Re: FreeBSD, IPFilter and Snort Bruno Miguel

Thursday, 13 September

Clean-up mysql DB Stefano
Problems connecting to mysql on localhost. gfricke
Now what? Subba Rao
Re: Clean-up mysql DB roman
Loopback alert JC Rodz
snort.conf snortlst snortlst
RE: snort.conf Johnson, David
RE: snort.conf Erek Adams
RE: snort.conf Martijn Heemels
RE: snort.conf Steve Halligan
Forcing an interface into promis mode at bootup gfricke
RE: Forcing an interface into promis mode at bootup Dan Fiorito
Re: Forcing an interface into promis mode at bootup Italo Antonio
[barnyard bug?]: No input plugins found for magic: a1b2c3d4 Matthew Callaway
Latest Win32 CVS Available : 1.8.1 b78 Michael Steele
Re: [barnyard bug?]: No input plugins found for magic: a1b2c3d4 Martin Roesch
WEB-MISC prefix-get // Sheahan, Paul (PCLN-NW)
Re: [barnyard bug?]: No input plugins found for magic: a1b2c3d4 Matthew Callaway
Re: Forcing an interface into promis mode at bootup Jim Kipp
Re: [barnyard bug?]: No input plugins found for magic: a1b2c3d4 Andrew R. Baker
SNORT on Trend Micro Interscan virus wall box Jonathon . Kalaugher
Re: SNORT on Trend Micro Interscan virus wall box Gordon Ewasiuk
HELP PLS!! #Snort received signal 3, exiting rick
Re: HELP PLS!! #Snort received signal 3, exiting John Sage
Re: HELP PLS!! #Snort received signal 3, exiting rick
Re: HELP PLS!! #Snort received signal 3, exiting Andrew R. Baker
Re: HELP PLS!! #Snort received signal 3, exiting rick

Friday, 14 September

Snort-Statistics-HOWTO proof read request Poppi, Sandro
Machine placement snortlst snortlst
TOS snortlst snortlst
Re: Forcing an interface into promis mode at bootup David Gadbois
Re: Machine placement Fran�ois D�sarm�nien
How to exclude alerts from within my home network. Peter Borner
Re: Machine placement snortlst snortlst
Promiscuous mode snortlst snortlst
Re: How to exclude alerts from within my home network. Randy Bradley
Re: How to exclude alerts from within my home network. Italo Antonio
OpenBSD compile error al3x payne
RE: Silcondefense.com Snort_1.8.b77_MSSQL_Binary Burleson, Lee (IA)
Re: TOS Beckster
Re: OpenBSD compile error Italo Antonio
RE: TOS Cessna, Michael
False Alert and IP Number George D. Nincehelser
Re: OpenBSD compile error roel
ACID & PHPlot John Ruff

Saturday, 15 September

Re: Promiscuous mode Ralf Hildebrandt
Re: ACID & PHPlot Andreas Hasenack
Re: ACID & PHPlot John Ruff
Re: ACID & PHPlot John Ruff
Re: False Alert and IP Number John Sage
Re: ACID & PHPlot roman
Re: ACID & PHPlot Andreas Hasenack
snort on freebsd Ilya
Re: snort on freebsd Erek Adams
loging Greg Sarsons
Question.. Chris Keladis
Snort Newbie Jason Withrow
PS: Snort Newbie Jason Withrow
BPF Filters? Jason Withrow

Sunday, 16 September

ARP WHo has? Jason Withrow
RE: Snort Newbie Neal Timm
Plea for text/plain gary . smith
Can someone help explain this alert? Peter Borner
Re: Can someone help explain this alert? Ralf Hildebrandt
Re: Usage stats. Bob Hillegas
Re: PS: Snort Newbie John Sage
Re: ARP WHo has? John Sage
Re: BPF Filters? John Sage
SYN and Win32 SnortLog Analyzer Jason Withrow
snort logs Ilya
Win32 Snort Log Analyzer Jason Withrow

Monday, 17 September

ACID 0.9.6b14 questions Poppi, Sandro
Port scanning Subba Rao
Code Red attacks Peter Borner
Re: Code Red attacks Gordon Ewasiuk
RE: Code Red attacks Jason Withrow
RE: Code Red attacks Gordon Ewasiuk
false positive + NAT Frederic Lemoine
RE: false positive + NAT Lee Brotherston
Re: Port scanning Erek Adams
Re: ACID 0.9.6b14 questions roman
acid-0.9.6b15: phplot graphs and time criteria Andreas Hasenack
XML Output acz [iSecureLabs]
FW: snort Core Dump Hall RJ
RE: acid-0.9.6b15: phplot graphs and time criteria Steve Halligan
Re: acid-0.9.6b15: phplot graphs and time criteria roman
Re: FW: snort Core Dump roman
Alert caching for ACID as a cron job Reeves, Michael (GEAE, Compaq)
RE: Alert caching for ACID as a cron job Reeves, Michael (GEAE, Compaq)
RE: Alert caching for ACID as a cron job Steve Halligan
e-mail alerts snortlst snortlst
Re: Alert caching for ACID as a cron job Italo Antonio
Re: e-mail alerts Erek Adams
Re: Port scanning Erek Adams
Silcondefense.com Snort_1.8.b77_MSSQL_Binary Stephen Shepherd
(no subject) Wells, Kenneth L
RE: e-mail alerts Steve Halligan
Re: (no subject) Wayne T Work
Re: Silcondefense.com Snort_1.8.b77_MSSQL_Binary Wayne T Work
Snort - MySql - ACID and multiple sensors bhayes
(no subject) Wells, Kenneth L
RE: (no subject) Wells, Kenneth L
RE: (no subject) Steve Halligan
Re: (no subject) Wayne T Work
RE: (no subject) Wayne T Work
RE: (no subject) Wayne T Work
RE: (no subject) Reeves, Michael (GEAE, Compaq)
Relocation Truncated to Fit Ian Marlier
Acid/MySQL and remote sensors Lists
RE: Code Red attacks Jason Withrow
RE: Code Red attacks Erek Adams
RE: Code Red attacks Gordon Ewasiuk
RE: Acid/MySQL and remote sensors Lists
RE: Code Red attacks Jason Withrow
RE: Code Red attacks Greg Wright
RE: Code Red attacks Jason Withrow
RE: Code Red attacks Jason Withrow
RE: Code Red attacks Jason Withrow
RE: Code Red attacks Erek Adams
openBSD compile error #2 al3x payne
Re: openBSD compile error #2 Brian
AW: (Snort-users) e-mail alerts sandro.poppi

Tuesday, 18 September

RE: Can someone help explain this alert? Peter Borner
BORROWED IP Alessandro Coppelli
Re: BORROWED IP Syed Mohammad Talha
RE: Code Red attacks Franki
Re: Port scanning Subba Rao
RE: Code Red attacks - a warning. Tom Rowan
Telnet alert... Syed Mohammad Talha
Snort on multiple interface... Syed Mohammad Talha
Alert ICMP Redirect Daniel Rune Jensen
AW: (Snort-users) Snort on multiple interface... sandro.poppi
RE: Silcondefense.com Snort_1.8.b77_MSSQL_Binary John Berkers
RE: Code Red attacks - a warning. Franki
RE: Code Red attacks Randy Bradley
Red Hat Linux 7.0 Wayne Sutherland
Code Green??? Matthew Francis
Re: Code Red attacks Tim Olson
Snort (rpm) die with big ping. (was: e-mail alerts) Bruno Gimenes Pereti
Passive OS Detection Joshua Wright
RE: Code Green??? Jim Howard
WEB-IIS Cmd attack Togan Muftuoglu
RE: Code Green??? Erek Adams
RE: Code Green??? Jim Howard
RE: Code Red attacks F.M. Taylor
is this a type of code red? richard
Same here Jim Forster
Re: WEB-IIS Cmd attack Dr SuSE
Re: WEB-IIS Cmd attack R P G
alert logging of non local lan SSH connections. Travis Farmer
Re: Code Green??? richard
RE: Code Green??? Steve Halligan
RE: Silcondefense.com Snort_1.8.b77_MSSQL_Binary Stephen Shepherd
RE: is this a type of code red? Dan Fiorito
Re: New worm going 'round? (fwd) Gordon Ewasiuk
Re: Code Green??? Dushyanth Harinath
Re: WEB-IIS Cmd attack John Sage
RE: Code Green??? Lodin, Steven {GZ-Q~Mannheim}
Re: Code Green??? Larry E. Smith Jr.
RE: Code Green??? Steve Halligan
New Worm bthaler
Promiscuous mode (again) snortlst snortlst
Re: WEB-IIS Cmd attack cdowns
RE: Code Green??? Ed Kasky
RE: Code Green??? richard
Re: Code Red attacks Alec Waters
Re: Promiscuous mode (again) Erek Adams
RE: Code Red attacks Erek Adams
worm probe (fwd) Gordon Ewasiuk
Re: WEB-IIS Cmd attack Togan Muftuoglu
RE: Snort (rpm) die with big ping. (was: e-mail ale rts) Lodin, Steven {GZ-Q~Mannheim}
Packet logs of Concept V.5 infection Steve Halligan
Re: General info Erek Adams
RE: Code Green??? Steve Halligan
New worm, dubbed Nimda Tom Sevy
Re: WEB-IIS Cmd attack Erek Adams
New Virus Ian Cudlip
RE: Code Red attacks Adrian Mink
RE: Code Red attacks Erek Adams
RE: Code Green??? John Steniger
nimda Olensky, Sven
capture data Schmeits, Roger
Re: Code Green??? Ian Cudlip
RE: New IIS Worm sduncan
help pcap problem James Fowler
Re: Code Green??? Ian Cudlip
RE: Code Green??? Tim Parker
General info snortlst snortlst
Nimda rules that may help Dr SuSE
Not CodeGreen bthaler
Garbage on my screen Syed Mohammad Talha
Code Green concept - Inoculation vs. Propagation Tobias Gilk
Sizing a machine for Snort Muscat, Tyrone J.
RE: Not CodeGreen Ginnetty, James
RE: Code Green??? Missaghi, Shawn
RE: Passive OS Detection Jyri Hovila
RE: Code Green??? Dominick, David
RE: Code Green??? Patrick Coomans
comparison Florin Andrei
Concept/Nimda Snort 1.8.1 rules Paul Asadoorian
Re: HOME_NETS Robert Lister
Need help fast! Sheahan, Paul (PCLN-NW)
I Got Infected Jason Withrow
Infected? Help Me Find Out! Jason Withrow
nimda W3C Logs Jason Withrow
Re: Infected? Help Me Find Out! Brian
Re: alert logging of non local lan SSH connections. Brian
RE: Need help fast! Anthony Geoffron
RE: Infected? Help Me Find Out! Greg Wright
RE: Infected? Help Me Find Out! Jason Withrow
Re: Sizing a machine for Snort Erek Adams