Network Security Archives

November 29, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:19
Re: [Snort-sigs] bleeding.rules.tar.gz over SSL is broken, Astarna, 13:28
Re: [Snort-sigs] bleeding.rules.tar.gz over SSL is broken, Matt Jonkman, 13:28
Re: [Snort-sigs] The rule 1054 fires up false positives!, Victor Meghesan, 13:18
[Snort-sigs] How to verify the new snort rules ?, Eddie, 13:18
[Snort-sigs] bleeding.rules.tar.gz over SSL is broken, Astarna, 13:18
[Snort-sigs] Snortcenter and updating rules, John Hally, 11:37
Re: [Snort-sigs] Flase +ves for SID 2590 SMTP MAIL FROM overflow attempt, Alex Kirk, 11:16

November 28, 2004

Re: [Snort-sigs] (no subject), Brian caswell, 13:28
Re: [Snort-sigs] (no subject), warwick ackfin, 06:05
RE: [Snort-sigs] A newb question on Snort Rules, nnposter, 03:44
[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 03:24
Re: [Snort-sigs] (no subject), warwick ackfin, 00:23

November 27, 2004

[Snort-sigs] (no subject), nnposter, 21:01

November 26, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:32
[Snort-sigs] Flase +ves for SID 2590 SMTP MAIL FROM overflow attempt, nnposter, 04:20
[Snort-sigs] A newb question on Snort Rules, warwick ackfin, 01:19

November 25, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:18
[Snort-sigs] False +ves for 2657 EXPLOIT SSLv2 Client_Hello with pad Challenge Length overflow attempt, Russell Fulton, 18:25
Re: [Snort-sigs] The rule 1054 fires up false positives!, nnposter, 17:55
[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 12:32
[Snort-sigs] Craig C Anderson/seh is out of the office., Craig C Anderson, 10:41
Re: [Snort-sigs] The rule 1054 fires up false positives!, Matt Kettler, 07:40
[Snort-sigs] Hi!, roesch, 05:59
[Snort-sigs] Flase +ves for SID 2590 SMTP MAIL FROM overflow attempt, Russell Fulton, 04:18
RE: [Snort-sigs] Strange behavior with http_inspect_server, Joe Patterson, 03:38

November 24, 2004

Re: [Snort-sigs] sig 2671, Matthew Watchinski, 20:55
Re: [Snort-sigs] Substitute for removed MS04-028 exploiting jpeg rule?, Matt Jonkman, 19:34
[Snort-sigs] netbios rules, Tim Slighter, 19:14
Re: [Snort-sigs] Substitute for removed MS04-028 exploiting jpeg rule?, Chris Kronberg, 14:42
Re: [Snort-sigs] Substitute for removed MS04-028 exploiting jpeg rule?, Matt Jonkman, 14:02
Re: [Snort-sigs] Substitute for removed MS04-028 exploiting jpeg rule?, Alex Kirk, 13:32
[Snort-sigs] Substitute for removed MS04-028 exploiting jpeg rule?, Chris Kronberg, 11:41
[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 00:16

November 22, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:10
Re: [Snort-sigs] The rule 1054 fires up false positives!, Matt Kettler, 21:09
[Snort-sigs] Strange behavior with http_inspect_server, Joe Patterson, 18:58
[Snort-sigs] False Positive: Snort Sig 1980: BACKDOOR Deepthroat 3.1 Connection attempt, Nagendra, Vasuki, 11:44
Re: [Snort-sigs] The rule 1054 fires up false positives!, Victor Meghesan, 11:44
[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 00:06

November 21, 2004

Re: [Snort-sigs] The rule 1054 fires up false positives!, Matthew Watchinski, 19:48
Re: [Snort-sigs] False Negative Submission, Matthew Watchinski, 18:36

November 20, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:36
Re: [Snort-sigs] what triggers spp_stream4: TTL Evasion attempt, Matt Kettler, 18:32

November 19, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:12
Re: [Snort-sigs] False Positive on rule ID 1365 (WEB-ATTACKS rm command attempt), Nigel Houghton, 16:39
[Snort-sigs] web-attacks.rules: many false positives, Benjamin Case, 16:29
[Snort-sigs] False Negative Submission, Matthew K. Lee, 16:29
[Snort-sigs] The rule 1054 fires up false positives!, Victor Meghesan, 16:29
[Snort-sigs] False Positive on rule ID 1365 (WEB-ATTACKS rm command attempt), McKenzie, Omar, 16:18
[Snort-sigs] Dragon sigs to SNORT, Richard Ferro, 16:18
[Snort-sigs] False Positive Report for SID 2109, Peter M. Abraham, 16:18
[Snort-sigs] sig 2671, James Affeld, 16:18
[Snort-sigs] (no subject), Doug McLean, 16:18
[Snort-sigs] DNS Spoof probably has false positive, chatiman, 16:18

November 18, 2004

Re: [Snort-sigs] Multiple content requirements in single rule, force order requirement, Jason, 23:59
Re: [Snort-sigs] what triggers spp_stream4: TTL Evasion attempt, Nigel Houghton, 17:56
[Snort-sigs] what triggers spp_stream4: TTL Evasion attempt, Russell Fulton, 17:06
RE: [Snort-sigs] Multiple content requirements in single rule, force order requirement, Gould, Scott, 13:54
Re: [Snort-sigs] Multiple content requirements in single rule, force order requirement, Alex Kirk, 11:03
[Snort-sigs] Multiple content requirements in single rule, force order requirement, Gould, Scott, 06:41
Re: [Snort-sigs] Any sigs for detecting wireless activity?, Nick, 06:11
[Snort-sigs] Any sigs for detecting wireless activity?, Jeffrey Lowe, 02:30

November 17, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:29
[Snort-sigs] False Positive for 1386, Esler, Joel - Contractor, 19:06

November 16, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:07
[Snort-sigs] SID 2001439 fails on Bleedingsnort Rulesets, Rocio Alfonso Pita, 07:08

November 15, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:14
Re: [Snort-sigs] False +ves on 2586 -- P2P eDonkey transfer, Alex Kirk, 10:53

November 14, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:11

November 13, 2004

Re: [Snort-sigs] False +ves on 2586 -- P2P eDonkey transfer, Hugo van der Kooij, 07:21

November 12, 2004

[Snort-sigs] Case-sensitivity in 2570.6 (WEB-MISC Invalid HTTP Version String), nnposter, 21:27
Re: [Snort-sigs] False +ves on 2586 -- P2P eDonkey transfer, Alex Kirk, 14:53
Re: [Snort-sigs] False +ves on 2586 -- P2P eDonkey transfer, Hugo van der Kooij, 14:43
Re: [Snort-sigs] False +ves on 2586 -- P2P eDonkey transfer, Matt Jonkman, 12:32
Re: [Snort-sigs] False +ves on 2586 -- P2P eDonkey transfer, Chich Thierry, 05:29

November 11, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:06
[Snort-sigs] Re: snort-rules update @ Thu Nov 11 15:27:17 2004, Brian, 17:44
[Snort-sigs] snort-rules update @ Thu Nov 11 15:27:17 2004, bmc, 17:34

November 10, 2004

[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 22:16
[Snort-sigs] False +ves on 2586 -- P2P eDonkey transfer, Russell Fulton, 18:44
[Snort-sigs] Possible False Positive on SID 2381???, Seth Art, 13:32
Re: [Snort-sigs] Bleedingsnort.com Daily Update, Matt Jonkman, 00:47

November 09, 2004

Re: [Snort-sigs] Bleedingsnort.com Daily Update, Jason Haar, 23:26
[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 23:16
Re: [Snort-sigs] Korgo.X, Matt Jonkman, 20:04
[Snort-sigs] Korgo.X, Rowland, Krisa W ERDC-ITL-MS Contractor, 19:14

November 08, 2004

[Snort-sigs] Alert Cache, Paul McMonagle, 15:01
Re: [Snort-sigs] Alert Cache, Nigel Houghton, 14:21

November 06, 2004

Re: [Snort-sigs] [SIFTER] Sensitive Content, Matt Jonkman, 03:57
[Snort-sigs] [SIFTER] Sensitive Content, Mail Administrator, 00:56
[Snort-sigs] [SIFTER] Sensitive Content, Mail Administrator, 00:06

November 05, 2004

[Snort-sigs] Case-sensitivity in 542.10 (CHAT IRC nick change), nnposter, 22:45
RE: [Snort-sigs] Proposal for addition of author to standard rule listings, Kevin L. Shaw, 16:42
RE: [Snort-sigs] Proposal for addition of author to standard rule listings, James Ashton, 15:01
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Frank Knobbe, 13:11
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Nigel Houghton, 13:01
RE: [Snort-sigs] Proposal for addition of author to standard rule listings, M. Shirk, 09:29
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Chich Thierry, 07:18
[Snort-sigs] Bleedingsnort.com Daily Update, matt, 01:46

November 04, 2004

Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Brian, 14:52
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Hugo van der Kooij, 04:27
Re: [Snort-sigs] Bleedingsnort.com Daily Update, Matt Jonkman, 00:26
[Snort-sigs] Bleedingsnort.com Daily Update, matt, 00:15

November 03, 2004

Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Frank Knobbe, 23:15
Re: [Snort-sigs] Bleedingsnort.com Daily Update, James Riden, 22:35
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Jason, 22:15
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Jason, 21:34
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Matt Jonkman, 20:04
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Nigel Houghton, 19:53
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Frank Knobbe, 19:43
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Nigel Houghton, 19:33
Re: [Snort-sigs] Bleedingsnort.com Daily Update, Brian, 19:13
[Snort-sigs] Proposal for addition of author to standard rule listings, Frank Knobbe, 19:03
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Matt Jonkman, 18:53
Re: [Snort-sigs] Proposal for addition of author to standard rule listings, Brian, 17:53
[Snort-sigs] RPC errors, Rowland, Krisa W ERDC-ITL-MS Contractor, 17:32
[Snort-sigs] Bleedingsnort.com Daily Update, matt, 03:46

November 02, 2004

Re: [Snort-sigs] False Positive for Probable Zafi Vrus outbound via SMTP rul, Matt Jonkman, 21:44
Re: [Snort-sigs] False Positive for Probable Zafi Vrus outbound via SMTP rul, Matt Jonkman, 19:12
RE: [Snort-sigs] False Positive for Probable Zafi Vrus outbound via SMTP rul, Kalbfleisch, Gary, 17:52
[Snort-users] Re: help us help you, Brian, 16:51
[Snort-sigs] False Positive for Probable Zafi Vrus outbound via SMTP rul, Kalbfleisch, Gary, 15:41
Re: [Snort-sigs] suggested changes to rule 2229, Matthew Watchinski, 00:13

November 01, 2004

[Snort-sigs] [Snort-users] help us help you, Brian, 22:02
[Snort-sigs] help us help you, Brian, 20:42
[Snort-sigs] Bleedingsnort.com Daily Update, matt, 00:11