Snort IDS Signatures Development (thread)

[Snort-users] Overhead caused by PCRE?, Jeff McCarthy, 2005/02/28
[Snort-sigs] FPs with "NETBIOS SMB Trans2 FIND_FIRST2 response overflow attempt", Jason Haar, 2005/02/28
[Snort-sigs] False positive and negative in 2416.5 (FTP invalid MDTM command attempt), nnposter, 2005/02/28
[Snort-sigs] Broken 1653.7 (WEB-CGI campus access ), nnposter, 2005/02/28
[Snort-sigs] SID 1:1384 False Positive, nikns, 2005/02/25
[Snort-sigs] New signatures for CAN numbers below, Stephanie Tan, 2005/02/25
- Re: [Snort-sigs] New signatures for CAN numbers below, Nigel Houghton, 2005/02/25
[Snort-sigs] Symantec vulnerability, Rowland, Krisa W ERDC-ITL-MS Contractor, 2005/02/22
- Message not available
  - Re: [Snort-sigs] Symantec vulnerability, Matt Kettler, 2005/02/23
[Snort-sigs] False positive in the intrusion prevention, Esbjörn Krantzén , 2005/02/21
[Snort-sigs] SID 1:2278 False Positive, Juan Alvarez Ferrando, 2005/02/21
[Snort-sigs] Assessing your malware exposure with Snort, particle . bored, 2005/02/21
[Snort-sigs] sid 2586 False positive documentation, Burtoft, Jim, 2005/02/21
[Snort-sigs] Bleeding rules virus and threshold issue, James Lay, 2005/02/19
- Re: [Snort-sigs] Bleeding rules virus and threshold issue, Matt Jonkman, 2005/02/19
- RE: [Snort-sigs] Bleeding rules virus and threshold issue, James Lay, 2005/02/21
  - Re: [Snort-sigs] Bleeding rules virus and threshold issue, Matt Jonkman, 2005/02/21
    - Re: [Snort-sigs] Bleeding rules virus and threshold issue, Frank Knobbe, 2005/02/21
- RE: [Snort-sigs] Bleeding rules virus and threshold issue, James Lay, 2005/02/21
  - RE: [Snort-sigs] Bleeding rules virus and threshold issue, Frank Knobbe, 2005/02/21
    - RE: [Snort-sigs] Bleeding rules virus and threshold issue, Frank Knobbe, 2005/02/21
- RE: [Snort-sigs] Bleeding rules virus and threshold issue, James Lay, 2005/02/21
- RE: [Snort-sigs] Bleeding rules virus and threshold issue, James Lay, 2005/02/21
  - RE: [Snort-sigs] Bleeding rules virus and threshold issue, Frank Knobbe, 2005/02/21
- RE: [Snort-sigs] Bleeding rules virus and threshold issue, James Lay, 2005/02/21
  - RE: [Snort-sigs] Bleeding rules virus and threshold issue, Frank Knobbe, 2005/02/21
- RE: [Snort-sigs] Bleeding rules virus and threshold issue, James Lay, 2005/02/21
  - RE: [Snort-sigs] Bleeding rules virus and threshold issue, Frank Knobbe, 2005/02/21
- RE: [Snort-sigs] Bleeding rules virus and threshold issue, Mark Scott, 2005/02/22
[Snort-sigs] FP for WEB-CLIENT winamp .cda file name overflow attempt Sig ID 3088, Russell Fulton, 2005/02/19
[Snort-sigs] Anyone got an *incoming* Bropia rule?, Jason Haar, 2005/02/18
[Snort-sigs] OT: cleanup in Bleeding edge rules, Jason Haar, 2005/02/14
- Re: [Snort-sigs] OT: cleanup in Bleeding edge rules, Frank Knobbe, 2005/02/14
- Re: [Snort-sigs] OT: cleanup in Bleeding edge rules, Matt Jonkman, 2005/02/21
[Snort-sigs] FPs for BLEEDING-EDGE SSL Bomb DoS Attempt sid:2000016, Russell Fulton, 2005/02/14
[Snort-sigs] Possible error in 3066.2 (IMAP append overflow attempt), nnposter, 2005/02/11
[Snort-sigs] snort-rules update @ Fri Feb 11 16:16:31 2005, bmc, 2005/02/11
[Snort-sigs] AOL and SID2570, mdpeters, 2005/02/10
[Snort-sigs] snort-rules update @ Wed Feb 9 20:15:50 2005, bmc, 2005/02/09
- Re: [Snort-sigs] snort-rules update @ Wed Feb 9 20:15:50 2005, Frank Knobbe, 2005/02/10
[Snort-sigs] Windows Messenger/MSN Messenger, Jaramillo, Paul D [CC], 2005/02/09
- Re: [Snort-sigs] Windows Messenger/MSN Messenger, J-H Johansen, 2005/02/09
- Re: [Snort-sigs] Windows Messenger/MSN Messenger, Matt Jonkman, 2005/02/21
- RE: [Snort-sigs] Windows Messenger/MSN Messenger, Jaramillo, Paul D [CC], 2005/02/09
[Snort-sigs] Update to snort rules (SNMP AgentX/tcp request), Bill Bernabe, 2005/02/09
[Snort-sigs] SID:2229 - False positives, Paul Schmehl, 2005/02/08
- RE: [Snort-sigs] SID:2229 - False positives, Ofer Shezaf, 2005/02/21
[Snort-sigs] WINS Rule Testing Requested, Alex Kirk, 2005/02/08
[Snort-sigs] snort usage, s a, 2005/02/07
[Snort-sigs] Help find error, Brian Jameson, 2005/02/07
[Snort-sigs] (no subject), Brian Jameson, 2005/02/07
[Snort-sigs] SIG 1:2515 Possible False Positive submission, Clay P. Campbell, 2005/02/07
[Snort-sigs] False positive with Nagios check_http, Carsten Schmitz, 2005/02/07
- Re: [Snort-sigs] False positive with Nagios check_http, Frank Knobbe, 2005/02/07
- [Snort-sigs] http post on port 25, hans, 2005/02/08
  - RE: [Snort-sigs] http post on port 25, Joe Patterson, 2005/02/08
    - Re: [Snort-sigs] http post on port 25, hans, 2005/02/08
    - RE: [Snort-sigs] http post on port 25, Joe Patterson, 2005/02/08
    - Re: [Snort-sigs] http post on port 25, hans, 2005/02/09
[Snort-sigs] False positive in 882.5 (WEB-CGI calendar access), nnposter, 2005/02/04
- Re: [Snort-sigs] False positive in 882.5 (WEB-CGI calendar access), BoFH, 2005/02/04
[Snort-sigs] SnortCenter, Paul Ryan, 2005/02/04
[Snort-sigs] Regarding Snort usage, s a, 2005/02/04
Re: [Snort-users] streaming media detection, Seth Art, 2005/02/03
- Re: [Snort-users] streaming media detection, Joel Esler, 2005/02/04
[Snort-sigs] New LSASS Worm?, Wiryanto Victor, 2005/02/03
- Re: [Snort-sigs] New LSASS Worm?, James Riden, 2005/02/03
  - RE: [Snort-sigs] New LSASS Worm?, Wiryanto Victor, 2005/02/03
Re: [Snort-sigs] False negative in 3087.1 (WEB-IIS w3who.dll buffer overflow attempt), Frank Knobbe, 2005/02/03
- Re: [Snort-sigs] False negative in 3087.1 (WEB-IIS w3who.dll buffer overflow attempt), Nigel Houghton, 2005/02/03
  - Re: [Snort-sigs] False negative in 3087.1 (WEB-IIS w3who.dll buffer overflow attempt), Frank Knobbe, 2005/02/03
    - Re: [Snort-sigs] False negative in 3087.1 (WEB-IIS w3who.dll buffer overflow attempt), Nigel Houghton, 2005/02/03
    - Re: [Snort-sigs] False negative in 3087.1 (WEB-IIS w3who.dll buffer overflow attempt), Frank Knobbe, 2005/02/03
    - Re: [Snort-sigs] False negative in 3087.1 (WEB-IIS w3who.dll buffer overflow attempt), Nigel Houghton, 2005/02/03
    - RE: [Snort-sigs] False negative in 3087.1 (WEB-IIS w3who.dllbuffer overflow attempt), Joe Patterson, 2005/02/03
    - RE: [Snort-sigs] False negative in 3087.1 (WEB-IIS w3who.dllbuffer overflow attempt), Frank Knobbe, 2005/02/03
[Snort-sigs] Duplicate icmp SID 482?, xaz129, 2005/02/02
- [Snort-sigs] Fwd: Duplicate icmp SID 482?, xaz129, 2005/02/02
[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/02
- Why the large updates: [Snort-sigs] Bleedingsnort.com Daily Update, Matt Jonkman, 2005/02/02
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/02
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/03
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/04
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/08
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/09
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/11
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/14
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/14
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/15
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/16
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/17
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/18
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/19
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/20
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/21
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/21
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/22
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/23
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/24
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/02/28
[Snort-sigs] False positive, Tim Boyer, 2005/02/02