Snort IDS Signatures Development (thread)

[Snort-sigs] Re: Snort-sigs digest, Vol 1 #1443 - 1 msg, Nick Plante, 2005/07/30
[Snort-sigs] add variable on snort.conf, why not ?, rmkml, 2005/07/29
- Re: [Snort-sigs] add variable on snort.conf, why not ?, Frank Knobbe, 2005/07/29
[Snort-sigs] modify port 80 to $HTTP_PORTS ? (snort233b14), rmkml, 2005/07/29
[Snort-sigs] add microsoft on reference.config file ?, rmkml, 2005/07/29
[Snort-sigs] add cert on reference.config file ?, rmkml, 2005/07/29
[Snort-sigs] add established on sid 2048 ?, rmkml, 2005/07/29
[Snort-sigs] Snort Rule: 3472 inconsistency, \"JC\", 2005/07/25
[Snort-sigs] Snort rule: 686 Reference URL incomplete, \"JC\", 2005/07/25
- Re: [Snort-sigs] Snort rule: 686 Reference URL incomplete, Nigel Houghton, 2005/07/25
[Snort-sigs] sid:3677 SIP UDP overflow - false positives, Rich Adamson, 2005/07/21
[Snort-users] Movin' on up..., Joel Esler, 2005/07/21
[Snort-sigs] rogue wireless access points, Rowland, Krisa W ERDC-ITL-MS Contractor, 2005/07/20
[Snort-sigs] Sql Bakups Snort Rule, Joseph Pierini, 2005/07/20
- Re: [Snort-sigs] Sql Bakups Snort Rule, nnposter, 2005/07/20
- Re: [Snort-sigs] Sql Bakups Snort Rule, Sanjay Rawat, 2005/07/21
[Snort-sigs] Re: Snort-sigs digest, Vol 1 #1432 - 6 msgs, Nick Plante, 2005/07/19
[Snort-sigs] Matching question, Ron, 2005/07/18
- Re: [Snort-sigs] Matching question, Jason Brvenik, 2005/07/18
- Re: [Snort-sigs] Matching question, Jason Brvenik, 2005/07/18
  - Re: [Snort-sigs] Matching question, Ron, 2005/07/19
- Re: [Snort-sigs] Matching question, bmc, 2005/07/19
  - Re: [Snort-sigs] Matching question, Ron, 2005/07/19
[Snort-sigs] sigs to catch response traffic, Russell Fulton, 2005/07/17
- Re: [Snort-sigs] sigs to catch response traffic, Matt Jonkman, 2005/07/17
  - RE: [Snort-sigs] sigs to catch response traffic, Steven Sturges, 2005/07/18
- Re: [Snort-sigs] sigs to catch response traffic, Jason Brvenik, 2005/07/18
[Snort-sigs] 1:2515 false positive, giulio . martinat, 2005/07/14
[Snort-sigs] Rule:2229, Joel Ebrahimi, 2005/07/14
[Snort-sigs] question, Jidong Long, 2005/07/14
[Snort-sigs] False positive Id=1:1113, Loriente Ara, Luis Antonio, 2005/07/14
[Snort-sigs] Fp ON 2001702, Michael Scheidell, 2005/07/14
- [Snort-sigs] Re: Fp ON 2001702, Matt Jonkman, 2005/07/05
  - Re: [Snort-sigs] Re: Fp ON 2001702, Colin Grady, 2005/07/05
    - Re: [Snort-sigs] Re: Fp ON 2001702, Frank Knobbe, 2005/07/05
- [Snort-sigs] Re: Fp ON 2001702, Frank Knobbe, 2005/07/05
- Re: [Snort-sigs] Fp ON 2001702, Matt Jonkman, 2005/07/14
[Snort-sigs] change msg nortan to norton on sid 2485 (snort233b14), rmkml, 2005/07/12
[Snort-sigs] SID 3466 reference incorrect, \"JC\", 2005/07/10
- Re: [Snort-sigs] SID 3466 reference incorrect, Nigel Houghton, 2005/07/10
[Snort-sigs] Re: Snort-sigs digest, Vol 1 #1422 - 3 msgs, Nick Plante, 2005/07/08
[Snort-sigs] new multiple change on sid (snort233b14), rmkml, 2005/07/08
[Snort-sigs] SSH brute force attack sig, Paul Schmehl, 2005/07/06
- Re: [Snort-sigs] SSH brute force attack sig, Matt Jonkman, 2005/07/06
  - Re: [Snort-sigs] SSH brute force attack sig, Paul Schmehl, 2005/07/06
    - Re: [Snort-sigs] SSH brute force attack sig, Wes Young, 2005/07/06
    - Re: [Snort-sigs] SSH brute force attack sig, Matt Jonkman, 2005/07/06
    - Re: [Snort-sigs] SSH brute force attack sig, Erik Fichtner, 2005/07/06
    - Re: [Snort-sigs] SSH brute force attack sig, Paul Schmehl, 2005/07/06
- Re: [Snort-sigs] SSH brute force attack sig, Michael Sierchio, 2005/07/06
  - Re: [Snort-sigs] SSH brute force attack sig, Paul Schmehl, 2005/07/06
- Re: [Snort-sigs] SSH brute force attack sig, bmc, 2005/07/06
  - Re: [Snort-sigs] SSH brute force attack sig, Matt Jonkman, 2005/07/06
  - Re: [Snort-sigs] SSH brute force attack sig, Russell Fulton, 2005/07/06
- Re: [Snort-sigs] SSH brute force attack sig, bmc, 2005/07/06
  - Re: [Snort-sigs] SSH brute force attack sig, Frank Knobbe, 2005/07/06
- Re: [Snort-sigs] SSH brute force attack sig, bmc, 2005/07/07
  - Re: [Snort-sigs] SSH brute force attack sig, Matt Jonkman, 2005/07/07
    - Re: [Snort-sigs] SSH brute force attack sig, Nigel Houghton, 2005/07/07
    - Re: [Snort-sigs] SSH brute force attack sig, Matt Jonkman, 2005/07/07
    - Re: [Snort-sigs] SSH brute force attack sig, Jeff Kell, 2005/07/07
    - Re: [Snort-sigs] SSH brute force attack sig, Paul Schmehl, 2005/07/07
    - Re: [Snort-sigs] SSH brute force attack sig, Jason Haar, 2005/07/07
    - Re: [Snort-sigs] SSH brute force attack sig, James Riden, 2005/07/07
- Re: [Snort-sigs] SSH brute force attack sig, bmc, 2005/07/07
[Snort-sigs] FP - 3696 (Veritas), Wes Young, 2005/07/06
[Snort-sigs] (no subject), Jure S, 2005/07/06
[Snort-users] Bleeding-Edge Virus 2001268 false positive (SWEN.A), Rich Adamson, 2005/07/05
[Snort-sigs] FPs on 1653 - WEB-CGI campus access, Jeff Kell, 2005/07/05
- Re: [Snort-sigs] FPs on 1653 - WEB-CGI campus access, Nigel Houghton, 2005/07/05
[Snort-sigs] FP on 1365 - Web attack rm attempt, Jeff Kell, 2005/07/05
[Snort-sigs] First Meeting of the Open Source Snort Rules Consortium (OSSRC), Jennifer Steffens, 2005/07/05
- Re: [Snort-sigs] First Meeting of the Open Source Snort Rules Consortium (OSSRC), Jennifer Steffens, 2005/07/05
[Snort-sigs] False +VE for NETBIOS DCERPC IActivation little endian bind attempt,Sig ID,3276, Russell Fulton, 2005/07/05
- Re: [Snort-sigs] False +VE for NETBIOS DCERPC IActivation little endian bind attempt,Sig ID,3276, Joel Esler, 2005/07/05
  - Re: [Snort-sigs] False +VE for NETBIOS DCERPC IActivation little endian bind attempt,Sig ID,3276, Russell Fulton, 2005/07/05
    - Re: [Snort-sigs] False +VE for NETBIOS DCERPC IActivation little endian bind attempt,Sig ID,3276, Nigel Houghton, 2005/07/05
[Snort-sigs] "CHAT IRC channel join" seems wrong, Colin Grady, 2005/07/05
- [Snort-sigs] Re: "CHAT IRC channel join" seems wrong, Colin Grady, 2005/07/05
  - [Snort-sigs] Re: "CHAT IRC channel join" seems wrong, Colin Grady, 2005/07/05
[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/05
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/05
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/05
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/05
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/05
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/05
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/05
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/06
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/07
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/08
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/09
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/10
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/11
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/12
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/14
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/15
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/17
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/18
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/19
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/20
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/21
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/22
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/23
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/24
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/25
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/26
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/27
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/28
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/29
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/30
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/07/31
[Snort-sigs] Sourcefire VRT Certified Rules Update, Matthew Watchinski, 2005/07/05
- [Snort-sigs] Sourcefire VRT Certified Rules Update, Matthew Watchinski, 2005/07/05
- [Snort-sigs] Sourcefire VRT Certified Rules Update, Matthew Watchinski, 2005/07/08
- [Snort-sigs] Sourcefire VRT Certified Rules Update, Matthew Watchinski, 2005/07/22