Snort IDS Signatures Development (thread)

[Snort-sigs] Apache mod_rewrite off-by-one sig, Jon Hart, 2006/07/31
- Re: [Snort-sigs] Apache mod_rewrite off-by-one sig, Joel Esler, 2006/07/31
  - Re: [Snort-sigs] Apache mod_rewrite off-by-one sig, Jon Hart, 2006/07/31
[Snort-sigs] Question on function of "within" command, Al Roethlisberger, 2006/07/31
- Re: [Snort-sigs] Question on function of "within" command, Joel Esler, 2006/07/31
[Snort-sigs] any way to disable these alerts:http_inspect: OVERSIZE REQUEST-URI DIRECTORY, Russell Fulton, 2006/07/30
- Re: [Snort-sigs] any way to disable these alerts:http_inspect: OVERSIZE REQUEST-URI DIRECTORY, Joel Esler, 2006/07/31
[Snort-sigs] seeing thousands of hits on COMMUNITY EXPLOIT Windows Acrobat Reader Activex Overflow Exploit, Sig ID, 100000101, Russell Fulton, 2006/07/30
[Snort-sigs] Glen Joseph is out of the office., Glen Joseph, 2006/07/29
[Snort-sigs] CN=Marty Bostick/OU=IS/O=PLC is out of the office., Marty . Bostick, 2006/07/29
[Snort-sigs] bad rule, Gentoo-Wally, 2006/07/29
- Re: [Snort-sigs] bad rule, Justin Heath, 2006/07/30
  - Re: [Snort-sigs] bad rule, Gentoo-Wally, 2006/07/31
[Snort-sigs] Sean C Baumann is out of the office., Baumann, Sean, 2006/07/21
[Snort-sigs] FP on 2329, trains, 2006/07/21
- Re: [Snort-sigs] FP on 2329, Nigel Houghton, 2006/07/21
- Re: [Snort-sigs] FP on 2329, Matthew Watchinski, 2006/07/21
[Snort-sigs] FP community rule sid:100000689; rev:1, Michael Scheidell, 2006/07/21
[Snort-sigs] Mike Potamousis/Poughkeepsie/Contr/IBM is out of the office., Mike Potamousis, 2006/07/14
[Snort-sigs] Suppressing both SRC AND DST in threshold.conf?, Eric Hines, 2006/07/14
[Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
- Re: [Snort-sigs] SNMP Missing Community String Signature FP, Matt Kettler, 2006/07/13
  - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
  - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
  - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Frank Knobbe, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Frank Knobbe, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
- Re: [Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
  - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Blake Hartstein, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Nigel Houghton, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Matt Kettler, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Nigel Houghton, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Nigel Houghton, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Matthew Watchinski, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Jon Hart, 2006/07/13
    - Re: [Snort-sigs] SNMP Missing Community String Signature FP, Eric Hines, 2006/07/13
[Snort-sigs] FPs for COMMUNITY WEB-PHP Particle Wiki PHP SQL Injection attempt, Sig ID, 100000446, Russell Fulton, 2006/07/13
[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/14
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/18
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/21
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/22
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/28
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/29
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2006/07/31
[Snort-sigs] Sid 1893 FP, Jon Hart, 2006/07/13
- Re: [Snort-sigs] Sid 1893 FP, Blake Hartstein, 2006/07/13
  - Re: [Snort-sigs] Sid 1893 FP, Jon Hart, 2006/07/13
[Snort-sigs] rule for Non-SSL traffic on SSL port?, Hellman, Matthew, 2006/07/13
- Re: [Snort-sigs] rule for Non-SSL traffic on SSL port?, Lorine Ruotolo, 2006/07/13
- Re: [Snort-sigs] rule for Non-SSL traffic on SSL port?, Russell Fulton, 2006/07/13
  - Re: [Snort-sigs] rule for Non-SSL traffic on SSL port?, Jeff Kell, 2006/07/13
  - Re: [Snort-sigs] rule for Non-SSL traffic on SSL port?, Jason Brvenik, 2006/07/13
[Snort-sigs] Rule for identifying all trafic except the specefied one, Rajkumar S, 2006/07/13
- Re: [Snort-sigs] Rule for identifying all trafic except the specefied, Jeff Kell, 2006/07/13
  - Re: [Snort-sigs] Rule for identifying all trafic except the specefied, Rajkumar S, 2006/07/13
    - Re: [Snort-sigs] Rule for identifying all trafic except the specefied, Chich Thierry, 2006/07/13
    - Re: [Snort-sigs] Rule for identifying all trafic except the specefied, Rajkumar S, 2006/07/13
[Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT, 2006/07/13
- [Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT, 2006/07/13
- [Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT, 2006/07/13
- [Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT, 2006/07/13
- [Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT, 2006/07/13
- [Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT, 2006/07/29
[Snort-sigs] Odd thresholding error, Russell Fulton, 2006/07/13
[Snort-sigs] Rules about keylogging, Chich Thierry, 2006/07/13
[Snort-sigs] FPs on AddPrinterEx unicode little endian overflow attempt, Sig ID, 4485, Russell Fulton, 2006/07/13
[Snort-users] Dragon Rules Name Change, Matt Jonkman, 2006/07/13
[Snort-sigs] Snort v2.4.5 and v2.6.0 Final Available, Jennifer Steffens, 2006/07/13
[Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2006/07/13
- [Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2006/07/13
- [Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2006/07/13
  - Re: [Snort-sigs] Snort Community Rules Update, Blake Hartstein, 2006/07/13
- [Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2006/07/13
- [Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2006/07/13
- [Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2006/07/14
- [Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2006/07/17