We can't all be paid to write Snort rules full time. So, thanks for contributing, keep it up an keep learning.<div><br class="webkit-block-placeholder"></div><div><br class="webkit-block-placeholder"></div><div>Cheers,</div>
<div>Justin<br><br><div class="gmail_quote">On Mon, Apr 7, 2008 at 9:53 PM, Paul Melson <<a href="mailto:pmelson@...11827...">pmelson@...11827...</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
> Some good snort rules by Team0x42<br>
> Shellcode detection, Web attack detection, DoS detection and web-misc<br>
rules You can download the rule set from:<br>
> <a href="http://team0x42.homeunix.org/projects.html" target="_blank">http://team0x42.homeunix.org/projects.html</a><br>
<br>
I mean, good for you for learning to write Snort rules and then sharing that<br>
back with the community.  Keep it up.  But honestly, I wouldn't actually run<br>
this rule set.  If you're interested in hearing my reasons why, I'm happy to<br>
share them with the intent that you may learn to write better rules.<br>
<br>
PaulM (Revere)<br>
<br>
PS - BMC's got his own room at the back of the bus.<br>
<br>
<br>
<br>
-------------------------------------------------------------------------<br>
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference<br>
Register now and save $200. Hurry, offer ends at 11:59 p.m.,<br>
Monday, April 7! Use priority code J8TLD2.<br>
<a href="http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone" target="_blank">http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone</a><br>
_______________________________________________<br>
Snort-users mailing list<br>
<a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a><br>
Go to this URL to change user options or unsubscribe:<br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users<br>
Snort-users</a> list archive:<br>
<a href="http://www.geocrawler.com/redir-sf.php3?list=snort-users" target="_blank">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a><br>
</blockquote></div><br></div>