snort-inline-users — The goal of this list is to help users debug/use snort_inline

[Snort-inline-users] how to get snort_inline rules

[vishal_nitr <vis...@re...>]

Hi ALL,   I am a new comer in the snort_inline community and want to use snort_inline as an IPS. I searched for the rules but I got only snort rules not the snort_inline rules.can any body help me in getting snort_inline rules and how to use them ? Thank You.

Thanks and Regards,
Vishal Kotalwar,
Software Engineer,
Aricent,
Chennai-35.
09884074047.

Re: [Snort-inline-users] good rules

[Matt J. <jo...@jo...>]

There's emergingthreats.net as well of course 
(www.emergingthreats.net/rules)

But no matter what set you use, you'll have to go through and look at 
every sig and decide if you want to block, and if so which side to block 
(src, dest, both, etc)

It's a horribly tedious task, but necessary. And you'll find your 
understanding of the ruleset much greater once you're done.

When I have to do so I try to set a chunk of the ruleset a day to get 
done. Pick a category a day for the smaller ones. But don't try to power 
through it all in one sitting, you'll glaze over and miss stuff.

Matt

Robert Mcmillen wrote:
> Does anyone have a good set of snort_inline rules or know a good  
> location to find them?
> 
> Rob
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
> Don't miss this year's exciting event. There's still time to save $100. 
> Use priority code J8TL2D2. 
> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc

Re: [Snort-inline-users] good rules

[Earl <esa...@hu...>]

I consulted Brian Casswell before I built his snortconfig into the 
Honeywall.  He has a special switch to convert IDS rules for use as 
IPS rules (I think its --honeynet, check:
$svn/honeywall/honeywall/trunk/rpm-devel/roo-
base/src/hw/sbin/hwruleupdate)

After running that, however, I see a LOT of rules do NOT get 
converted to DROP (some do).  I know Brian has reasons for at least 
some of them not getting converted (perhaps Wills comments here are 
some).

Not sure if that helps but thats what I've got...  Glad to help 
(more) if I can.

Earl


On Tue, 15 Apr 2008 20:10:34 -0400 Will Metcalf 
<wil...@gm...> wrote:
>I think it is assumed rules will be tweaked for ones own 
>environment.
>Rob, I think that you are kind of in a unique situation in that 
>you
>are trying to protect the rest of the world from your network.  
>Some
>things to stay away from...
>
>Anything with flowbits:noalert; you want to make sure you don't 
>set to
>drop as a lot of these rules are used in protocol
>identification/behavior, and are later checked in a separate rule 
>that
>does alert/drop.
>
>Ditch the replace ruleset.  The problem with this is that now that 
>you
>have pcre, uricontent, and other normalized data it is not safe to
>generate a ruleset that will replace the content matches in the 
>rule.
>You might have a content match that is also used for protocol
>identification/behavior and the bad juju lives in the pcre and or
>uricontent portion of the rule.
>
>Maybe for Honeywall you leave this as an exercise for the user.  
>Just
>a suggestion...
>
>Regards,
>
>Will
>
>On Tue, Apr 15, 2008 at 5:56 PM, Joel Esler <es...@gm...> 
>wrote:
>> Afaik there are not a specific set of rules that are by default 
>set to
>>  drop.  You'd need to do this using oinkmaster or something.  As 
>far as
>>  rulesets, there a bunch out there!
>>
>>  --
>>  Joel Esler
>>  Sent from the iRoad.
>>
>>
>>
>>  On Apr 15, 2008, at 6:48 PM, Robert Mcmillen 
><rv...@gm...> wrote:
>>
>>  > Any issues with proper service operation due the change of 
>all alert
>>  > rules to drop?
>>  >
>>  > Do you exclude any rule files from snort_inline.conf or do 
>you use
>>  > every single snort rule converted to drop?
>>  >
>>  > Thank in advance,
>>  >
>>  > Rob
>>  >
>>  >
>>  > On Apr 15, 2008, at 5:33 PM, xyon wrote:
>>  >
>>  >> I typically download the rules, then run oinkmaster 
>configured with a
>>  >> regex to prefix all rules with "drop: " instead of "alert: 
>". I then
>>  >> run
>>  >> snort (2.7.0) with the -Q switch.
>>  >>
>>  >> HTH
>>  >
>>  > ---
>>  > --------------------------------------------------------------
>--------
>>  > This SF.net email is sponsored by the 2008 JavaOne(SM) 
>Conference
>>  > Don't miss this year's exciting event. There's still time to 
>save
>>  > $100.
>>  > Use priority code J8TL2D2.
>>  > 
>http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.
>com/javaone
>>  > _______________________________________________
>>  > Snort-inline-users mailing list
>>  > Sno...@li...
>>  > https://lists.sourceforge.net/lists/listinfo/snort-inline-
>users
>>
>>  ----------------------------------------------------------------
>---------
>>  This SF.net email is sponsored by the 2008 JavaOne(SM) 
>Conference
>>  Don't miss this year's exciting event. There's still time to 
>save $100.
>>  Use priority code J8TL2D2.
>>  
>http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.
>com/javaone
>>  _______________________________________________
>>  Snort-inline-users mailing list
>>  Sno...@li...
>>  https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>
>
>-------------------------------------------------------------------
>------
>This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
>Don't miss this year's exciting event. There's still time to save 
>$100. 
>Use priority code J8TL2D2. 
>http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.
>com/javaone
>_______________________________________________
>Snort-inline-users mailing list
>Sno...@li...
>https://lists.sourceforge.net/lists/listinfo/snort-inline-users

Re: [Snort-inline-users] good rules

[Will M. <wil...@gm...>]

I think it is assumed rules will be tweaked for ones own environment.
Rob, I think that you are kind of in a unique situation in that you
are trying to protect the rest of the world from your network.  Some
things to stay away from...

Anything with flowbits:noalert; you want to make sure you don't set to
drop as a lot of these rules are used in protocol
identification/behavior, and are later checked in a separate rule that
does alert/drop.

Ditch the replace ruleset.  The problem with this is that now that you
have pcre, uricontent, and other normalized data it is not safe to
generate a ruleset that will replace the content matches in the rule.
You might have a content match that is also used for protocol
identification/behavior and the bad juju lives in the pcre and or
uricontent portion of the rule.

Maybe for Honeywall you leave this as an exercise for the user.  Just
a suggestion...

Regards,

Will

On Tue, Apr 15, 2008 at 5:56 PM, Joel Esler <es...@gm...> wrote:
> Afaik there are not a specific set of rules that are by default set to
>  drop.  You'd need to do this using oinkmaster or something.  As far as
>  rulesets, there a bunch out there!
>
>  --
>  Joel Esler
>  Sent from the iRoad.
>
>
>
>  On Apr 15, 2008, at 6:48 PM, Robert Mcmillen <rv...@gm...> wrote:
>
>  > Any issues with proper service operation due the change of all alert
>  > rules to drop?
>  >
>  > Do you exclude any rule files from snort_inline.conf or do you use
>  > every single snort rule converted to drop?
>  >
>  > Thank in advance,
>  >
>  > Rob
>  >
>  >
>  > On Apr 15, 2008, at 5:33 PM, xyon wrote:
>  >
>  >> I typically download the rules, then run oinkmaster configured with a
>  >> regex to prefix all rules with "drop: " instead of "alert: ". I then
>  >> run
>  >> snort (2.7.0) with the -Q switch.
>  >>
>  >> HTH
>  >
>  > ---
>  > ----------------------------------------------------------------------
>  > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
>  > Don't miss this year's exciting event. There's still time to save
>  > $100.
>  > Use priority code J8TL2D2.
>  > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
>  > _______________________________________________
>  > Snort-inline-users mailing list
>  > Sno...@li...
>  > https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>  -------------------------------------------------------------------------
>  This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
>  Don't miss this year's exciting event. There's still time to save $100.
>  Use priority code J8TL2D2.
>  http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
>  _______________________________________________
>  Snort-inline-users mailing list
>  Sno...@li...
>  https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>

Re: [Snort-inline-users] good rules

[Joel E. <es...@gm...>]

Afaik there are not a specific set of rules that are by default set to  
drop.  You'd need to do this using oinkmaster or something.  As far as  
rulesets, there a bunch out there!

--
Joel Esler
Sent from the iRoad.

On Apr 15, 2008, at 6:48 PM, Robert Mcmillen <rv...@gm...> wrote:

> Any issues with proper service operation due the change of all alert
> rules to drop?
>
> Do you exclude any rule files from snort_inline.conf or do you use
> every single snort rule converted to drop?
>
> Thank in advance,
>
> Rob
>
>
> On Apr 15, 2008, at 5:33 PM, xyon wrote:
>
>> I typically download the rules, then run oinkmaster configured with a
>> regex to prefix all rules with "drop: " instead of "alert: ". I then
>> run
>> snort (2.7.0) with the -Q switch.
>>
>> HTH
>
> --- 
> ----------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> Don't miss this year's exciting event. There's still time to save  
> $100.
> Use priority code J8TL2D2.
> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users

Re: [Snort-inline-users] good rules

[Robert M. <rv...@gm...>]

Any issues with proper service operation due the change of all alert  
rules to drop?

Do you exclude any rule files from snort_inline.conf or do you use  
every single snort rule converted to drop?

Thank in advance,

Rob


On Apr 15, 2008, at 5:33 PM, xyon wrote:

> I typically download the rules, then run oinkmaster configured with a
> regex to prefix all rules with "drop: " instead of "alert: ". I then  
> run
> snort (2.7.0) with the -Q switch.
>
> HTH

Re: [Snort-inline-users] good rules

[xyon <xy...@in...>]

I typically download the rules, then run oinkmaster configured with a
regex to prefix all rules with "drop: " instead of "alert: ". I then run
snort (2.7.0) with the -Q switch.

HTH


On Tue, 2008-04-15 at 17:13 -0500, Robert Mcmillen wrote:
> Community section is only for snort right?  Does not have snort_inline  
> specific rules?
> 
> Rob
> 
> On Apr 15, 2008, at 4:18 PM, xyon wrote:
> 
> > You could try these:
> >
> > http://www.snort.org/pub-bin/downloads.cgi#COMM
> >
> > (Community section)
> >
> > On Tue, 2008-04-15 at 16:09 -0500, Robert Mcmillen wrote:
> >> Does anyone have a good set of snort_inline rules or know a good
> >> location to find them?
> >>
> >> Rob
> >>
> >> -------------------------------------------------------------------------
> >> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> >> Don't miss this year's exciting event. There's still time to save  
> >> $100.
> >> Use priority code J8TL2D2.
> >> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> >> _______________________________________________
> >> Snort-inline-users mailing list
> >> Sno...@li...
> >> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
> >
> 
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
> Don't miss this year's exciting event. There's still time to save $100. 
> Use priority code J8TL2D2. 
> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users

Re: [Snort-inline-users] good rules

[Robert M. <rv...@gm...>]

Community section is only for snort right?  Does not have snort_inline  
specific rules?

Rob

On Apr 15, 2008, at 4:18 PM, xyon wrote:

> You could try these:
>
> http://www.snort.org/pub-bin/downloads.cgi#COMM
>
> (Community section)
>
> On Tue, 2008-04-15 at 16:09 -0500, Robert Mcmillen wrote:
>> Does anyone have a good set of snort_inline rules or know a good
>> location to find them?
>>
>> Rob
>>
>> -------------------------------------------------------------------------
>> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
>> Don't miss this year's exciting event. There's still time to save  
>> $100.
>> Use priority code J8TL2D2.
>> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
>> _______________________________________________
>> Snort-inline-users mailing list
>> Sno...@li...
>> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>

Re: [Snort-inline-users] good rules

[xyon <xy...@in...>]

You could try these:

http://www.snort.org/pub-bin/downloads.cgi#COMM

(Community section)

On Tue, 2008-04-15 at 16:09 -0500, Robert Mcmillen wrote:
> Does anyone have a good set of snort_inline rules or know a good  
> location to find them?
> 
> Rob
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
> Don't miss this year's exciting event. There's still time to save $100. 
> Use priority code J8TL2D2. 
> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users

[Snort-inline-users] good rules

[Robert M. <rv...@gm...>]

Does anyone have a good set of snort_inline rules or know a good  
location to find them?

Rob

[Snort-inline-users] What if someone scans my snort_inline host?

[ChuZhenlin <ch...@16...>]

1.My host have snort_inline running with appropriate rules and some ftp, mysql services. If someone scans my host, can I set appropriate rules to prvent my host without reveal my services information? That is , not let the scanner know what services are on my host.

2.What result will a scanner report if a host drop all the packet from the scanner?

Sorry for the question because I dont have a test device in hand and I need the answer right now.

Thanks

[Snort-inline-users] How to improve performance of snort_inline+iptables ?

[ChuZhenlin <ch...@16...>]

I have snort_inline+iptables in my linux transparent bridge. What can I do to improve the system performance.
1.Change the source code of snort_inline and iptables. Any links?
2.Optimize the rules. Any links?
3.Recompile the kernel?
4.?

Anybody help me?
Thanks

Re: [Snort-inline-users] can snort_inline adjust its rules dynamically?

[Will M. <wil...@gm...>]

see sticky-drop in the snort_inline.conf

On Wed, Apr 2, 2008 at 9:41 AM, ChuZhenlin <ch...@16...> wrote:
>
>
> Hi,
>
> I wonder if snort_inline can adjust its rules dynamically. When it finds a
> scan host, can it drop all packets from the scanner? Any other cases?
>
> Maybe the question is too simple. Any reply will be appreciated. Thanks
> -------------------------------------------------------------------------
>  Check out the new SourceForge.net Marketplace.
>  It's the best place to buy or sell services for
>  just about anything Open Source.
>
> http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
> _______________________________________________
>  Snort-inline-users mailing list
>  Sno...@li...
>  https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>

[Snort-inline-users] can snort_inline adjust its rules dynamically?

[ChuZhenlin <ch...@16...>]

Hi,

I wonder if snort_inline can adjust its rules dynamically. When it finds a scan host, can it drop all packets from the scanner? Any other cases?

Maybe the question is too simple. Any reply will be appreciated. Thanks

[Snort-inline-users] NFQUEUE bug in kernel 2.6.24.X

[Eric L. <er...@in...>]

Hi snort-inline users,

I'm sending you this e-mail to warn you about a problem in kernel
2.6.24.X.

Packets in some range are dropped by NFQUEUE :

More informations:
http://forums.inl.fr/viewtopic.php?pid=322#p322

Patcg:
http://thread.gmane.org/gmane.comp.security.firewalls.netfilter.devel/23384/focus=23385

It may explain some weird problems if someone test snort-inline with
such a kernel.

BR,
-- 
Eric Leblond
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/

Re: [Snort-inline-users] Snort installation on a Modem

[Jason <sec...@br...>]

in that space and with those constraints you are probably better off 
going with ngrep.

Will Metcalf wrote:
> Errrr where are you going to load your rules if there is no RAM?
> 
> On Fri, Feb 29, 2008 at 6:45 AM,  <Ash...@ar...> wrote:
>> Hi,
>>
>> I would like to install snort-inline on a modem that has typically 8MB
>> flash. There will be no RAM in a modem. Execution space will be shared
>> within that 8MB, I suppose. I have a compressed Linux OS in that flash.
>> Since I have a little resource, I can allocate only 1MB for snort binary,
>> though some space will be provided for snort running also.
>>
>> From the version snort-inline-2.6.1.5 I got the binary of size 2.9MB. Please
>> suggest some way to compress it as much as possible, I dont want any
>> advanced pre-processors or modules. Just a basic working snort is
>> sufficient.
>>
>> Thanks,
>> Ashok SV
>>
>> ***********************  Aricent-Unclassified   ***********************
>> "DISCLAIMER: This message is proprietary to Aricent and is intended solely
>> for the use of
>> the individual to whom it is addressed. It may contain
>> privileged or confidential information and should not be
>> circulated or used
>> for any purpose other than for what it is intended. If you have received
>> this message in error,
>> please notify the originator immediately. If you are
>> not the intended recipient, you are notified that you are
>> strictly
>> prohibited from using, copying, altering, or disclosing the
>> contents of this message. Aricent accepts no responsibility for
>> loss or
>> damage arising from the use of the information transmitted by this email
>> including damage from virus."
>>
>>
>> -------------------------------------------------------------------------
>> This SF.net email is sponsored by: Microsoft
>> Defy all challenges. Microsoft(R) Visual Studio 2008.
>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>> _______________________________________________
>> Snort-inline-users mailing list
>> Sno...@li...
>> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>
>>
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
> 

Re: [Snort-inline-users] Snort installation on a Modem

[Will M. <wil...@gm...>]

Errrr where are you going to load your rules if there is no RAM?

On Fri, Feb 29, 2008 at 6:45 AM,  <Ash...@ar...> wrote:
>
> Hi,
>
> I would like to install snort-inline on a modem that has typically 8MB
> flash. There will be no RAM in a modem. Execution space will be shared
> within that 8MB, I suppose. I have a compressed Linux OS in that flash.
> Since I have a little resource, I can allocate only 1MB for snort binary,
> though some space will be provided for snort running also.
>
> From the version snort-inline-2.6.1.5 I got the binary of size 2.9MB. Please
> suggest some way to compress it as much as possible, I dont want any
> advanced pre-processors or modules. Just a basic working snort is
> sufficient.
>
> Thanks,
> Ashok SV
>
> ***********************  Aricent-Unclassified   ***********************
> "DISCLAIMER: This message is proprietary to Aricent and is intended solely
> for the use of
> the individual to whom it is addressed. It may contain
> privileged or confidential information and should not be
> circulated or used
> for any purpose other than for what it is intended. If you have received
> this message in error,
> please notify the originator immediately. If you are
> not the intended recipient, you are notified that you are
> strictly
> prohibited from using, copying, altering, or disclosing the
> contents of this message. Aricent accepts no responsibility for
> loss or
> damage arising from the use of the information transmitted by this email
> including damage from virus."
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>

[Snort-inline-users] Snort installation on a Modem

[<Ash...@ar...>]

Hi,

I would like to install snort-inline on a modem that has typically 8MB 
flash. There will be no RAM in a modem. Execution space will be shared 
within that 8MB, I suppose. I have a compressed Linux OS in that flash. 
Since I have a little resource, I can allocate only 1MB for snort binary, 
though some space will be provided for snort running also.

From the version snort-inline-2.6.1.5 I got the binary of size 2.9MB. 
Please suggest some way to compress it as much as possible, I dont want 
any advanced pre-processors or modules. Just a basic working snort is 
sufficient.

Thanks,
Ashok SV

***********************  Aricent-Unclassified   ***********************
"DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of 
the individual to whom it is addressed. It may contain privileged or confidential information and should not be 
circulated or used for any purpose other than for what it is intended. If you have received this message in error, 
please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly
prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for 
loss or damage arising from the use of the information transmitted by this email including damage from virus."

[Snort-inline-users] I've added you as a friend on StumbleUpon

[<naj...@gm...>]

StumbleUpon

Discover new web sites
Mnajem wants to Share his Favorites with you


He likes8 pages

Connect with people that like the same sites you
do on StumbleUpon.
Come check out StumbleUpon - it's really cool!

-&mnajem
& naj...@gm...



Connect with me &
http://www.stumbleupon.com/redirect.php?t=j&u=3868935&d=http%3A%2F%2Fwww.stumbleupon.com%2Fjoin.php%3Ffriend%3D1972468%26emailcode%3Dnxfzjphmwzhhji4s&l=2&c=nxfzjphmwzhhji4s




About StumbleUpon

StumbleUpon allows you to channel surf the
internet and discover great websites and web
content you might never have found. Whether it's a
website, video, picture, game, blog, or wiki, 
StumbleUpon helps you find interesting stuff
recommended by like-minded people with just a
single click of the Stumble! button.
Learn More
http://www.stumbleupon.com/redirect.php?t=j&u=3868935&l=3&c=nxfzjphmwzhhji4s
 



If you do not wish to receive future e-mail
invitations to join StumbleUpon, please click here
http://www.stumbleupon.com/redirect.php?t=j&u=3868935&d=http%3A%2F%2Fwww.stumbleupon.com%2Fnotifications.php%3Femailcode%3Dnxfzjphmwzhhji4s&l=4&c=nxfzjphmwzhhji4s
.

(c) StumbleUpon 2001-2008

Re: [Snort-inline-users] (no subject)

[Earl <esa...@hu...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Will,

Thanks for the heads up.  I think I missed this by a day ;P
We're looking at replacing  'snort --with inline' with your version
for 2.8 in the next (post 1.3) Honeywall.

Earl

On Thu, 27 Dec 2007 14:58:09 +0000 Will Metcalf
<wil...@gm...> wrote:
>Yeah that is the beauty of a low traffic list ;-) sorry for the
>spam.... snort_inline-2.8.0.1 is in the works... ;-)
>
>http://www.inliniac.net/blog/2007/12/22/working-on-snort_inline-
>2801.html
>
>On Dec 27, 2007 8:20 AM, Joel Esler <joe...@ma...> wrote:
>> You guys know you are responding to all right?
>>
>> --
>> Joel Esler
>> joe...@ma...
>> http://www.joelesler.net
>>
>>
>>
>>
>>
>> On Dec 27, 2007, at 8:58 AM, Matt Jonkman wrote:
>>
>> > Hey.
>> >
>> > I had intended to subscribe, but turns out I already was. :)
>> >
>> > So anyway, how's everybody? Have a good xmas?  :)
>> >
>> > Matt
>> >
>> > Will Metcalf wrote:
>> >> hi?
>> >>
>> >> On Dec 26, 2007 7:56 PM, Matt Jonkman <jo...@jo...>
>wrote:
>> >>> --
>> >>> --------------------------------------------
>> >>> Matthew Jonkman
>> >>> Emerging Threats
>> >>> US Phone 765-429-0398
>> >>> US Fax 312-264-0205
>> >>> AUS Fax 61-29-4750-026
>> >>> http://www.emergingthreats.net
>> >>> --------------------------------------------
>> >>>
>> >>> PGP: http://www.jonkmans.com/mattjonkman.asc
>> >>>
>> >>>
>> >>>
>> >>> -------------------------------------------------------------
>------------
>> >>> This SF.net email is sponsored by: Microsoft
>> >>> Defy all challenges. Microsoft(R) Visual Studio 2005.
>> >>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>> >>> _______________________________________________
>> >>> Snort-inline-users mailing list
>> >>> Sno...@li...
>> >>> https://lists.sourceforge.net/lists/listinfo/snort-inline-
>users
>> >>>
>> >
>> > --
>> > --------------------------------------------
>> > Matthew Jonkman
>> > Emerging Threats
>> > US Phone 765-429-0398
>> > US Fax 312-264-0205
>> > AUS Fax 61-29-4750-026
>> > http://www.emergingthreats.net
>> > --------------------------------------------
>> >
>> > PGP: http://www.jonkmans.com/mattjonkman.asc
>> >
>> >
>> >
>> > ---------------------------------------------------------------
>----------
>> > This SF.net email is sponsored by: Microsoft
>> > Defy all challenges. Microsoft(R) Visual Studio 2005.
>> > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>> > _______________________________________________
>> > Snort-inline-users mailing list
>> > Sno...@li...
>> > https://lists.sourceforge.net/lists/listinfo/snort-inline-
>users
>> >
>>
>>
>
>-------------------------------------------------------------------
>------
>This SF.net email is sponsored by: Microsoft
>Defy all challenges. Microsoft(R) Visual Studio 2005.
>http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>_______________________________________________
>Snort-inline-users mailing list
>Sno...@li...
>https://lists.sourceforge.net/lists/listinfo/snort-inline-users
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wkYEARECAAYFAkdzv2oACgkQk7+e+4lPSm2BmACdEJZHqm2y29FxKG7WIHIbGPJwtkcA
oIN47ihRKuniyJSQARuBS8vEo5kw
=jExF
-----END PGP SIGNATURE-----

Re: [Snort-inline-users] (no subject)

[Matt J. <jo...@jo...>]

Ya, what's it to you?

:)

Matt

Joel Esler wrote:
> You guys know you are responding to all right?
> 
> -- 
> Joel Esler
> joe...@ma...
> http://www.joelesler.net
> 
> 
> 
> 
> On Dec 27, 2007, at 8:58 AM, Matt Jonkman wrote:
> 
>> Hey.
>>
>> I had intended to subscribe, but turns out I already was. :)
>>
>> So anyway, how's everybody? Have a good xmas?  :)
>>
>> Matt
>>
>> Will Metcalf wrote:
>>> hi?
>>>
>>> On Dec 26, 2007 7:56 PM, Matt Jonkman <jo...@jo...> wrote:
>>>> -- 
>>>> --------------------------------------------
>>>> Matthew Jonkman
>>>> Emerging Threats
>>>> US Phone 765-429-0398
>>>> US Fax 312-264-0205
>>>> AUS Fax 61-29-4750-026
>>>> http://www.emergingthreats.net
>>>> --------------------------------------------
>>>>
>>>> PGP: http://www.jonkmans.com/mattjonkman.asc
>>>>
>>>>
>>>>
>>>> -------------------------------------------------------------------------
>>>>
>>>> This SF.net email is sponsored by: Microsoft
>>>> Defy all challenges. Microsoft(R) Visual Studio 2005.
>>>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>>>> _______________________________________________
>>>> Snort-inline-users mailing list
>>>> Sno...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>>>
>>
>> -- 
>> --------------------------------------------
>> Matthew Jonkman
>> Emerging Threats
>> US Phone 765-429-0398
>> US Fax 312-264-0205
>> AUS Fax 61-29-4750-026
>> http://www.emergingthreats.net
>> --------------------------------------------
>>
>> PGP: http://www.jonkmans.com/mattjonkman.asc
>>
>>
>>
>> -------------------------------------------------------------------------
>> This SF.net email is sponsored by: Microsoft
>> Defy all challenges. Microsoft(R) Visual Studio 2005.
>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>> _______________________________________________
>> Snort-inline-users mailing list
>> Sno...@li...
>> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
US Phone 765-429-0398
US Fax 312-264-0205
AUS Fax 61-29-4750-026
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc

[Snort-inline-users] Cesar Farro Flores on Holidays

[Cesar F. F. <ces...@t-...>]

Estar=E9 ausente de la oficina desde el  24/12/2007 y no volver=E9 hast=
a el
08/01/2008.



- Estar=E9 de Vacaciones fuera de Lima desde el 29 de Enero hasta el 19=
 de
Febrero del 2007, para consultas de proyectos realizarlas al Sr. Johnny=

Ramos (210-9619)

- I will be out of the office from Jan 29 to Feb 19, your message has b=
een
saved until my return, should you need immediate help,  please contact
Johnny Ramos
at (210-9619).

- Eu serei fora do escrit=F3rio de Enero 29 - Febrero 19. Se voce neces=
sitar
a ajuda imediata, contatar por favor :
Se=F1or Johnny Ramos (210 9619).

=

Re: [Snort-inline-users] (no subject)

[Will M. <wil...@gm...>]

Yeah that is the beauty of a low traffic list ;-) sorry for the
spam.... snort_inline-2.8.0.1 is in the works... ;-)

http://www.inliniac.net/blog/2007/12/22/working-on-snort_inline-2801.html

On Dec 27, 2007 8:20 AM, Joel Esler <joe...@ma...> wrote:
> You guys know you are responding to all right?
>
> --
> Joel Esler
> joe...@ma...
> http://www.joelesler.net
>
>
>
>
>
> On Dec 27, 2007, at 8:58 AM, Matt Jonkman wrote:
>
> > Hey.
> >
> > I had intended to subscribe, but turns out I already was. :)
> >
> > So anyway, how's everybody? Have a good xmas?  :)
> >
> > Matt
> >
> > Will Metcalf wrote:
> >> hi?
> >>
> >> On Dec 26, 2007 7:56 PM, Matt Jonkman <jo...@jo...> wrote:
> >>> --
> >>> --------------------------------------------
> >>> Matthew Jonkman
> >>> Emerging Threats
> >>> US Phone 765-429-0398
> >>> US Fax 312-264-0205
> >>> AUS Fax 61-29-4750-026
> >>> http://www.emergingthreats.net
> >>> --------------------------------------------
> >>>
> >>> PGP: http://www.jonkmans.com/mattjonkman.asc
> >>>
> >>>
> >>>
> >>> -------------------------------------------------------------------------
> >>> This SF.net email is sponsored by: Microsoft
> >>> Defy all challenges. Microsoft(R) Visual Studio 2005.
> >>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> >>> _______________________________________________
> >>> Snort-inline-users mailing list
> >>> Sno...@li...
> >>> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
> >>>
> >
> > --
> > --------------------------------------------
> > Matthew Jonkman
> > Emerging Threats
> > US Phone 765-429-0398
> > US Fax 312-264-0205
> > AUS Fax 61-29-4750-026
> > http://www.emergingthreats.net
> > --------------------------------------------
> >
> > PGP: http://www.jonkmans.com/mattjonkman.asc
> >
> >
> >
> > -------------------------------------------------------------------------
> > This SF.net email is sponsored by: Microsoft
> > Defy all challenges. Microsoft(R) Visual Studio 2005.
> > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> > _______________________________________________
> > Snort-inline-users mailing list
> > Sno...@li...
> > https://lists.sourceforge.net/lists/listinfo/snort-inline-users
> >
>
>

Re: [Snort-inline-users] (no subject)

[Matt J. <jo...@jo...>]

Hey.

I had intended to subscribe, but turns out I already was. :)

So anyway, how's everybody? Have a good xmas?  :)

Matt

Will Metcalf wrote:
> hi?
> 
> On Dec 26, 2007 7:56 PM, Matt Jonkman <jo...@jo...> wrote:
>> --
>> --------------------------------------------
>> Matthew Jonkman
>> Emerging Threats
>> US Phone 765-429-0398
>> US Fax 312-264-0205
>> AUS Fax 61-29-4750-026
>> http://www.emergingthreats.net
>> --------------------------------------------
>>
>> PGP: http://www.jonkmans.com/mattjonkman.asc
>>
>>
>>
>> -------------------------------------------------------------------------
>> This SF.net email is sponsored by: Microsoft
>> Defy all challenges. Microsoft(R) Visual Studio 2005.
>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>> _______________________________________________
>> Snort-inline-users mailing list
>> Sno...@li...
>> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>>

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
US Phone 765-429-0398
US Fax 312-264-0205
AUS Fax 61-29-4750-026
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc

Re: [Snort-inline-users] (no subject)

[Will M. <wil...@gm...>]

hi?

On Dec 26, 2007 7:56 PM, Matt Jonkman <jo...@jo...> wrote:
>
> --
> --------------------------------------------
> Matthew Jonkman
> Emerging Threats
> US Phone 765-429-0398
> US Fax 312-264-0205
> AUS Fax 61-29-4750-026
> http://www.emergingthreats.net
> --------------------------------------------
>
> PGP: http://www.jonkmans.com/mattjonkman.asc
>
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>