[Snort-sigs] unsubscribe

Furio Penteriani fpenteriani at ...3476...
Fri Apr 9 09:44:43 EDT 2010



-----Original Message-----
From: snort-sigs-request at lists.sourceforge.net
[mailto:snort-sigs-request at lists.sourceforge.net]
Sent: Thursday, April 08, 2010 8:17 PM
To: snort-sigs at lists.sourceforge.net
Subject: Snort-sigs Digest, Vol 47, Issue 11

Send Snort-sigs mailing list submissions to
	snort-sigs at lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/snort-sigs
or, via email, send a message with subject or body 'help' to
	snort-sigs-request at lists.sourceforge.net

You can reach the person managing the list at
	snort-sigs-owner at lists.sourceforge.net

When replying, please edit your Subject line so it is more specific than
"Re: Contents of Snort-sigs digest..."


Today's Topics:

   1. Re: Looking for HTTP POST's over 1mb in size (Alex Kirk)
   2. Re: Looking for HTTP POST's over 1mb in size
      (evilghost at ...3397...)


----------------------------------------------------------------------

Message: 1
Date: Thu, 8 Apr 2010 23:12:38 -0400
From: Alex Kirk <akirk at ...435...>
Subject: Re: [Snort-sigs] Looking for HTTP POST's over 1mb in size
To: "evilghost at ...3397..." <evilghost at ...3397...>
Cc: ??? <kimms at ...3282...>,	"SNORT-SIGS at lists.sourceforge.net"
	<SNORT-SIGS at lists.sourceforge.net>,
"David.R.Wharton at ...3400..."
	<David.R.Wharton at ...3400...>,	Matt Olney
<molney at ...435...>
Message-ID:
	<s2y8e0a702c1004082012z8117941fs7d0eac5a606b7a49 at ...2421...>
Content-Type: text/plain; charset="euc-kr"

True, but some of us are a bit gun-shy around colons in Snort rules - it
only takes screwing up a release once before you make a habit of
escaping colons wherever they may be found. :-P

2010/4/8 evilghost at ...3397... <evilghost at ...3397...>

> Colon doesn't need to be escaped in a PCRE, even in a Snort PCRE. It
> does in a content match. :)
>
> -evilghost
>
> Matt Olney wrote:
> > Actually (don't ask me why)...they both work:
> >
> > alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"PCRE with

> > colon"; pcre:"/User-Agent:/H"; classtype: attempted-admin; sid:
> > 33333;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
> > (msg:"PCRE with colon escaped"; pcre:"/User-Agent\:/H"; classtype:
> > attempted-admin;
> > sid: 33334;)
> >
> > Alerts:
> > 1:33333:0 PCRE with colon Alerts: 2
> > 1:33334:0 PCRE with colon escaped Alerts: 2
> >
> > [HTTP_HEADER BUFFER DATA (0x8ac90a0)]:
> > 55 73 65 72 2d 41 67 65 6e 74 3a 20 43 42 4e 65 User-Agent: CBNe
> > 74 44 61 74 61 53 65 74 0d 0a 48 6f 73 74 3a 20 tDataSet..Host:
> > 73 65 67 6d 65 6e 74 2e 70 77 30 38 2e 69 63 69 segment.pw08.ici
> > 62 61 2e 63 6f 6d 0d 0a 43 61 63 68 65 2d 43 6f ba.com..Cache-Co 6e
> > 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d 32 ntrol: max-age=2
> > 35 39 32 30 30 0d 0a 56 69 61 3a 20 31 2e 30 20 59200..Via: 1.0 50
> > 52 4f 58 59 0d 0a 43 6f 6e 6e 65 63 74 69 6f PROXY..Connectio 6e 3a
> > 20 63 6c 6f 73 65 0d 0a 0d n: close...
> >
> > Matt
> > (Who has been stupid busy, but is still listening)
> >
> > 2010/4/8 L0rd Ch0de1m0rt <l0rdch0de1m0rt at ...2420...
> > <mailto:l0rdch0de1m0rt at ...2420...>>
> >
> >     I disagree. Unless snort is not PCRE compatible (which it seems
they
> >     should be based on the acronym), you don't have to escape the
> > colon
> in
> >     this context for a pcre check.
> >
> >     Cheers,
> >
> >     -L0rd Ch0de1m0rt
> >
> >     On Thu, Apr 8, 2010 at 7:46 PM, ??? <kimms at ...3282...
> >     <mailto:kimms at ...3282...>> wrote:
> >     > Missed escape : \
> >     >
> >     > You have to write this
> >     >
> >     > pcre:"/^Content-Length\:\s*[0-9]{7,}$/i";
> >     > or
> >     > pcre:"/^Content-Length\x3a\s*[0-9]{7,}$/i";
> >     >
> >     > -----Original Message-----
> >     > From: evilghost at ...3397...
<mailto:evilghost at ...3397...>
> >     [mailto:evilghost at ...3397...
<mailto:evilghost at ...3397...>]
> >     > Sent: Friday, April 09, 2010 2:01 AM
> >     > To: JOSH RIVEL, BLOOMBERG/ 731 LEXIN
> >     > Cc: SNORT-SIGS at ...3473...
> >     <mailto:SNORT-SIGS at ...3473...>
> >     > Subject: Re: [Snort-sigs] Looking for HTTP POST's over 1mb in
size
> >     >
> >     > Glad to help Josh, also drop the '/s', I meant to write the
> > PCRE
> as:
> >     >
> >     > pcre:"/^Content-Length:\s*[0-9]{7,}$/i";
> >     >
> >     >
> >     > -evilghost
> >     >
> >     > JOSH RIVEL, BLOOMBERG/ 731 LEXIN wrote:
> >     >> evilghost-
> >     >> Yeah my PCRE skills are pretty weak. I'll try your change and
> >     let you know how it works out (I also change the source from
"any"
> >     to $HOME_NET as well)
> >     >> Thanks!!
> >     >> Josh
> >     >>
> >     >> ----- Original Message -----
> >     >> From: Evilghost at ...3475... <evilghost at ...3397...
> >     <mailto:evilghost at ...3397...>>
> >     >> To: JOSH RIVEL (BLOOMBERG/ 731 LEXIN)
> >     >> Cc: SNORT-SIGS at ...3473...
> >     <mailto:SNORT-SIGS at ...3473...>
> >     >> At: 4/08 12:49:17
> >     >>
> >     >> Hey Josh, isn't the root issue here 10[1-9] in the PCRE OR
> >     match since
> >     >> it'll match on on 101, 102, 103, etc?
> >     >>
> >     >> What about:
> >     >>
> >     >> pcre:"/^Content-Length:\s*[0-9]{7,}$/si";
> >     >>
> >     >> It'll still match against 1,000,000 bytes which is close
enough
> >     to 1Mb for me. Also, note sure why you need the other PCRE
flags.
> >     >>
> >     >> -evilghost
> >     >>
> >     >>
> >     >>
> >     >>
> >     >> JOSH RIVEL, BLOOMBERG/ 731 LEXIN wrote:
> >     >>
> >     >>> So I wrote a signature to detect HTTP POST's over 1mb in
size,
> >     but I think that my pcre logic is flawed. Can someone take a
look
> >     and let me know if this is OK? (It does work, but will trigger
on
> >     file sizes < 1mb based on the Content-Length: header)
> >     >>> (We have some stuff in there to ignore posts to certain
sites
> >     due to too many false positives)
> >     >>> The rule is:
> >     >>> alert tcp any !20 -> $EXTERNAL_NET !25
> >     (flow:established,to_server; priority:1; content:"POST"; nocase;
> >     http_method; content:!"Shockwave"; nocase; http_header;
> >     content:!"x-flash-version"; nocase; content:!"Host\: live.com
> >     <http://live.com>"; nocase; http_header; content:!"Host\:
> >     mail.google.com <http://mail.google.com>"; nocase; http_header;
> >     content:!"Host\: mail.yahoo.com <http://mail.yahoo.com>";
nocase;
> >     content:!"Host\: webmail.aol.com <http://webmail.aol.com>";
> >     nocase; http_header; content:!"Host\: webmail.juno.com
> >     <http://webmail.juno.com>"; nocase; http_header;
content:!"Host\:
> >     webmailb.juno.com <http://webmailb.juno.com>"; nocase;
> >     http_header; content:"multipart/"; nocase;
> >     content:"Content-Length\:"; nocase; http_header;
> >     pcre:"/^Content-Length:\s*([1-9][0-9]{6,}|10[1-9])/smix";
> >     pcre:!"/^Host:\s.*[\.live.com <http://live.com>]$/smi";
> >     msg:"http-post-pcre-jr"; classtype:policy-violation;
sid:1000060;
> >     gid:1; rev:4; )
> >     >>>
> >
> ----------------------------------------------------------------------
> --------
> >     >>> Download Intel® Parallel Studio Eval
> >     >>> Try the new software tools for yourself. Speed compiling,
find
> >     bugs
> >     >>> proactively, and fine-tune applications for parallel
performance.
> >     >>> See why Intel Parallel Studio got high marks during beta.
> >     >>> http://p.sf.net/sfu/intel-sw-dev
> >     >>> _______________________________________________
> >     >>> Snort-sigs mailing list
> >     >>> Snort-sigs at lists.sourceforge.net
> >     <mailto:Snort-sigs at lists.sourceforge.net>
> >     >>> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> >     >>>
> >     >>>
> >     >> >
> >     >
> >     >
> >
> ----------------------------------------------------------------------
> --------
> >     > Download Intel® Parallel Studio Eval
> >     > Try the new software tools for yourself. Speed compiling, find
bugs
> >     > proactively, and fine-tune applications for parallel
performance.
> >     > See why Intel Parallel Studio got high marks during beta.
> >     > http://p.sf.net/sfu/intel-sw-dev
> >     > _______________________________________________
> >     > Snort-sigs mailing list
> >     > Snort-sigs at lists.sourceforge.net
> >     <mailto:Snort-sigs at lists.sourceforge.net>
> >     > https://lists.sourceforge.net/lists/listinfo/snort-sigs
> >     >
> >     >
> >
> ----------------------------------------------------------------------
> --------
> >     > Download Intel® Parallel Studio Eval
> >     > Try the new software tools for yourself. Speed compiling, find
bugs
> >     > proactively, and fine-tune applications for parallel
performance.
> >     > See why Intel Parallel Studio got high marks during beta.
> >     > http://p.sf.net/sfu/intel-sw-dev
> >     > _______________________________________________
> >     > Snort-sigs mailing list
> >     > Snort-sigs at lists.sourceforge.net
> >     <mailto:Snort-sigs at lists.sourceforge.net>
> >     > https://lists.sourceforge.net/lists/listinfo/snort-sigs
> >     >
> >
> >
> ----------------------------------------------------------------------
> --------
> >     Download Intel® Parallel Studio Eval
> >     Try the new software tools for yourself. Speed compiling, find
bugs
> >     proactively, and fine-tune applications for parallel
performance.
> >     See why Intel Parallel Studio got high marks during beta.
> >     http://p.sf.net/sfu/intel-sw-dev
> >     _______________________________________________
> >     Snort-sigs mailing list
> >     Snort-sigs at lists.sourceforge.net
> >     <mailto:Snort-sigs at lists.sourceforge.net>
> >     https://lists.sourceforge.net/lists/listinfo/snort-sigs
> >
> >
> > --------------------------------------------------------------------
> > ----
> >
> >
> ----------------------------------------------------------------------
> --------
> > Download Intel® Parallel Studio Eval Try the new software tools

> > for yourself. Speed compiling, find bugs proactively, and fine-tune
> > applications for parallel performance.
> > See why Intel Parallel Studio got high marks during beta.
> > http://p.sf.net/sfu/intel-sw-dev
> > --------------------------------------------------------------------
> > ----
> >
> > _______________________________________________
> > Snort-sigs mailing list
> > Snort-sigs at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
> >
>
>
> ----------------------------------------------------------------------
> -------- Download Intel® Parallel Studio Eval Try the new
> software tools for yourself. Speed compiling, find bugs proactively,
> and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>



--
Alex Kirk
AEGIS Program Lead
Sourcefire Vulnerability Research Team
+1-410-423-1937
alex.kirk at ...435...
-------------- next part --------------
An HTML attachment was scrubbed...

------------------------------

Message: 2
Date: Thu, 8 Apr 2010 22:16:37 -0500
From: "evilghost at ...3397..." <evilghost at ...3397...>
Subject: Re: [Snort-sigs] Looking for HTTP POST's over 1mb in size
To: Matt Olney <molney at ...435...>
Cc: ??? <kimms at ...3282...>,	"SNORT-SIGS at lists.sourceforge.net"
	<SNORT-SIGS at lists.sourceforge.net>,
"David.R.Wharton at ...3400..."
	<David.R.Wharton at ...3400...>
Message-ID: <4BBE9C15.2030200 at ...3397...>
Content-Type: text/plain; charset="EUC-KR"

Well, according to the manual at least, we (someone) pointed it out as a
bug in the manual. I can't remember the thread.

-evilghost

Matt Olney wrote:
> Nope:
>
> Alerts:
> 1:33335:0 Content with colon Alerts: 2 1:33336:0 Content with |3A|
> Alerts: 2
>
>
>
> 2010/4/8 evilghost at ...3397... <mailto:evilghost at ...3397...>
> <evilghost at ...3397... <mailto:evilghost at ...3397...>>
>
>     Colon doesn't need to be escaped in a PCRE, even in a Snort PCRE.
It
>     does in a content match. :)
>
>     -evilghost
>
>     Matt Olney wrote:
>     > Actually (don't ask me why)...they both work:
>     >
>     > alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"PCRE
with
>     > colon"; pcre:"/User-Agent:/H"; classtype: attempted-admin; sid:
>     33333;)
>     > alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"PCRE
with
>     > colon escaped"; pcre:"/User-Agent\:/H"; classtype:
attempted-admin;
>     > sid: 33334;)
>     >
>     > Alerts:
>     > 1:33333:0 PCRE with colon Alerts: 2
>     > 1:33334:0 PCRE with colon escaped Alerts: 2
>     >
>     > [HTTP_HEADER BUFFER DATA (0x8ac90a0)]:
>     > 55 73 65 72 2d 41 67 65 6e 74 3a 20 43 42 4e 65 User-Agent: CBNe
>     > 74 44 61 74 61 53 65 74 0d 0a 48 6f 73 74 3a 20 tDataSet..Host:
>     > 73 65 67 6d 65 6e 74 2e 70 77 30 38 2e 69 63 69 segment.pw08.ici
>     > 62 61 2e 63 6f 6d 0d 0a 43 61 63 68 65 2d 43 6f ba.com..Cache-Co
>     > 6e 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d 32 ntrol: max-age=2
>     > 35 39 32 30 30 0d 0a 56 69 61 3a 20 31 2e 30 20 59200..Via: 1.0
>     > 50 52 4f 58 59 0d 0a 43 6f 6e 6e 65 63 74 69 6f PROXY..Connectio
>     > 6e 3a 20 63 6c 6f 73 65 0d 0a 0d n: close...
>     >
>     > Matt
>     > (Who has been stupid busy, but is still listening)
>     >
>     > 2010/4/8 L0rd Ch0de1m0rt <l0rdch0de1m0rt at ...2420...
>     <mailto:l0rdch0de1m0rt at ...2420...>
>     > <mailto:l0rdch0de1m0rt at ...2420...
<mailto:l0rdch0de1m0rt at ...2420...>>>
>     >
>     > I disagree. Unless snort is not PCRE compatible (which it seems
they
>     > should be based on the acronym), you don't have to escape the
>     colon in
>     > this context for a pcre check.
>     >
>     > Cheers,
>     >
>     > -L0rd Ch0de1m0rt
>     >
>     > On Thu, Apr 8, 2010 at 7:46 PM, ??? <kimms at ...3282...
>     <mailto:kimms at ...3282...>
>     > <mailto:kimms at ...3282... <mailto:kimms at ...3282...>>>
wrote:
>     > > Missed escape : \
>     > >
>     > > You have to write this
>     > >
>     > > pcre:"/^Content-Length\:\s*[0-9]{7,}$/i";
>     > > or
>     > > pcre:"/^Content-Length\x3a\s*[0-9]{7,}$/i";
>     > >
>     > > -----Original Message-----
>     > > From: evilghost at ...3397...
>     <mailto:evilghost at ...3397...> <mailto:evilghost at ...3397...
>     <mailto:evilghost at ...3397...>>
>     > [mailto:evilghost at ...3397...
>     <mailto:evilghost at ...3397...> <mailto:evilghost at ...3397...
>     <mailto:evilghost at ...3397...>>]
>     > > Sent: Friday, April 09, 2010 2:01 AM
>     > > To: JOSH RIVEL, BLOOMBERG/ 731 LEXIN
>     > > Cc: SNORT-SIGS at ...3473...
>     <mailto:SNORT-SIGS at ...3473...>
>     > <mailto:SNORT-SIGS at ...3473...
>     <mailto:SNORT-SIGS at ...3473...>>
>     > > Subject: Re: [Snort-sigs] Looking for HTTP POST's over 1mb in
size
>     > >
>     > > Glad to help Josh, also drop the '/s', I meant to write the
>     PCRE as:
>     > >
>     > > pcre:"/^Content-Length:\s*[0-9]{7,}$/i";
>     > >
>     > >
>     > > -evilghost
>     > >
>     > > JOSH RIVEL, BLOOMBERG/ 731 LEXIN wrote:
>     > >> evilghost-
>     > >> Yeah my PCRE skills are pretty weak. I'll try your change and
>     > let you know how it works out (I also change the source from
"any"
>     > to $HOME_NET as well)
>     > >> Thanks!!
>     > >> Josh
>     > >>
>     > >> ----- Original Message -----
>     > >> From: Evilghost at ...3475... <evilghost at ...3397...
>     <mailto:evilghost at ...3397...>
>     > <mailto:evilghost at ...3397...
<mailto:evilghost at ...3397...>>>
>     > >> To: JOSH RIVEL (BLOOMBERG/ 731 LEXIN)
>     > >> Cc: SNORT-SIGS at ...3473...
>     <mailto:SNORT-SIGS at ...3473...>
>     > <mailto:SNORT-SIGS at ...3473...
>     <mailto:SNORT-SIGS at ...3473...>>
>     > >> At: 4/08 12:49:17
>     > >>
>     > >> Hey Josh, isn't the root issue here 10[1-9] in the PCRE OR
>     > match since
>     > >> it'll match on on 101, 102, 103, etc?
>     > >>
>     > >> What about:
>     > >>
>     > >> pcre:"/^Content-Length:\s*[0-9]{7,}$/si";
>     > >>
>     > >> It'll still match against 1,000,000 bytes which is close
enough
>     > to 1Mb for me. Also, note sure why you need the other PCRE
flags.
>     > >>
>     > >> -evilghost
>     > >>
>     > >>
>     > >>
>     > >>
>     > >> JOSH RIVEL, BLOOMBERG/ 731 LEXIN wrote:
>     > >>
>     > >>> So I wrote a signature to detect HTTP POST's over 1mb in
size,
>     > but I think that my pcre logic is flawed. Can someone take a
look
>     > and let me know if this is OK? (It does work, but will trigger
on
>     > file sizes < 1mb based on the Content-Length: header)
>     > >>> (We have some stuff in there to ignore posts to certain
sites
>     > due to too many false positives)
>     > >>> The rule is:
>     > >>> alert tcp any !20 -> $EXTERNAL_NET !25
>     > (flow:established,to_server; priority:1; content:"POST"; nocase;
>     > http_method; content:!"Shockwave"; nocase; http_header;
>     > content:!"x-flash-version"; nocase; content:!"Host\: live.com
>     <http://live.com>
>     > <http://live.com>"; nocase; http_header; content:!"Host\:
>     > mail.google.com <http://mail.google.com>
>     <http://mail.google.com>"; nocase; http_header;
>     > content:!"Host\: mail.yahoo.com <http://mail.yahoo.com>
>     <http://mail.yahoo.com>"; nocase;
>     > content:!"Host\: webmail.aol.com <http://webmail.aol.com>
>     <http://webmail.aol.com>";
>     > nocase; http_header; content:!"Host\: webmail.juno.com
>     <http://webmail.juno.com>
>     > <http://webmail.juno.com>"; nocase; http_header;
content:!"Host\:
>     > webmailb.juno.com <http://webmailb.juno.com>
>     <http://webmailb.juno.com>"; nocase;
>     > http_header; content:"multipart/"; nocase;
>     > content:"Content-Length\:"; nocase; http_header;
>     > pcre:"/^Content-Length:\s*([1-9][0-9]{6,}|10[1-9])/smix";
>     > pcre:!"/^Host:\s.*[\.live.com <http://live.com>
>     <http://live.com>]$/smi";
>     > msg:"http-post-pcre-jr"; classtype:policy-violation;
sid:1000060;
>     > gid:1; rev:4; )
>     > >>>
>     >
>
------------------------------------------------------------------------
------
>     > >>> Download Intel® Parallel Studio Eval
>     > >>> Try the new software tools for yourself. Speed compiling,
find
>     > bugs
>     > >>> proactively, and fine-tune applications for parallel
>     performance.
>     > >>> See why Intel Parallel Studio got high marks during beta.
>     > >>> http://p.sf.net/sfu/intel-sw-dev
>     > >>> _______________________________________________
>     > >>> Snort-sigs mailing list
>     > >>> Snort-sigs at lists.sourceforge.net
>     <mailto:Snort-sigs at lists.sourceforge.net>
>     > <mailto:Snort-sigs at lists.sourceforge.net
>     <mailto:Snort-sigs at lists.sourceforge.net>>
>     > >>> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>     > >>>
>     > >>>
>     > >> >
>     > >
>     > >
>     >
>
------------------------------------------------------------------------
------
>     > > Download Intel® Parallel Studio Eval
>     > > Try the new software tools for yourself. Speed compiling, find
>     bugs
>     > > proactively, and fine-tune applications for parallel
performance.
>     > > See why Intel Parallel Studio got high marks during beta.
>     > > http://p.sf.net/sfu/intel-sw-dev
>     > > _______________________________________________
>     > > Snort-sigs mailing list
>     > > Snort-sigs at lists.sourceforge.net
>     <mailto:Snort-sigs at lists.sourceforge.net>
>     > <mailto:Snort-sigs at lists.sourceforge.net
>     <mailto:Snort-sigs at lists.sourceforge.net>>
>     > > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>     > >
>     > >
>     >
>
------------------------------------------------------------------------
------
>     > > Download Intel® Parallel Studio Eval
>     > > Try the new software tools for yourself. Speed compiling, find
>     bugs
>     > > proactively, and fine-tune applications for parallel
performance.
>     > > See why Intel Parallel Studio got high marks during beta.
>     > > http://p.sf.net/sfu/intel-sw-dev
>     > > _______________________________________________
>     > > Snort-sigs mailing list
>     > > Snort-sigs at lists.sourceforge.net
>     <mailto:Snort-sigs at lists.sourceforge.net>
>     > <mailto:Snort-sigs at lists.sourceforge.net
>     <mailto:Snort-sigs at lists.sourceforge.net>>
>     > > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>     > >
>     >
>     >
>
------------------------------------------------------------------------
------
>     > Download Intel® Parallel Studio Eval
>     > Try the new software tools for yourself. Speed compiling, find
bugs
>     > proactively, and fine-tune applications for parallel
performance.
>     > See why Intel Parallel Studio got high marks during beta.
>     > http://p.sf.net/sfu/intel-sw-dev
>     > _______________________________________________
>     > Snort-sigs mailing list
>     > Snort-sigs at lists.sourceforge.net
>     <mailto:Snort-sigs at lists.sourceforge.net>
>     > <mailto:Snort-sigs at lists.sourceforge.net
>     <mailto:Snort-sigs at lists.sourceforge.net>>
>     > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>     >
>     >
>     >
>
------------------------------------------------------------------------
>     >
>     >
>
------------------------------------------------------------------------
------
>     > Download Intel® Parallel Studio Eval
>     > Try the new software tools for yourself. Speed compiling, find
bugs
>     > proactively, and fine-tune applications for parallel
performance.
>     > See why Intel Parallel Studio got high marks during beta.
>     > http://p.sf.net/sfu/intel-sw-dev
>     >
>
------------------------------------------------------------------------
>     >
>     > _______________________________________________
>     > Snort-sigs mailing list
>     > Snort-sigs at lists.sourceforge.net
>     <mailto:Snort-sigs at lists.sourceforge.net>
>     > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>     >
>
>



------------------------------

------------------------------------------------------------------------
------
Download Intel® Parallel Studio Eval Try the new software tools for
yourself. Speed compiling, find bugs proactively, and fine-tune
applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev

------------------------------

_______________________________________________
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs


End of Snort-sigs Digest, Vol 47, Issue 11
******************************************




This message and any files or text attached to it are intended only for the recipients named above, and contain information that may be confidential or privileged. If you are not an intended recipient, you must not read, copy, use or disclose this communication. Please also notify the sender by replying to this message, and then delete all copies of it from your system. Thank you.




More information about the Snort-sigs mailing list