<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
 /* Font Definitions */
 @font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:Consolas;
        panose-1:2 11 6 9 2 2 4 3 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
p
        {mso-style-priority:99;
        mso-margin-top-alt:auto;
        margin-right:0in;
        mso-margin-bottom-alt:auto;
        margin-left:0in;
        font-size:12.0pt;
        font-family:"Times New Roman","serif";}
span.EmailStyle18
        {mso-style-type:personal-reply;
        font-family:"Calibri","sans-serif";
        color:#1F497D;}
.MsoChpDefault
        {mso-style-type:export-only;}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
-->
</style>
<!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext="edit">
  <o:idmap v:ext="edit" data="1" />
 </o:shapelayout></xml><![endif]-->
</head>

<body lang=EN-US link=blue vlink=purple>

<div class=WordSection1>

<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>That is was what I was guessing would be the end solution instead
of recompiling because recompiling might mean starting all over.  I just
needed to understand why it wasn’t working by reconfiguring the rules
files and the snort.conf also.  I can handle the suppression file I believe. 
If I can with one last question since you brought up the compile issue is there
anything else in particular that I might look out for that might have to do
with how I did compile snort?   Either way I appreciate all the help
and I’m sure this won’t be the last email that you or the list will
see with questions about configs from me.<o:p></o:p></span></p>

<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>

<p class=MsoNormal><b><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Greg Lane<o:p></o:p></span></b></p>

<p class=MsoNormal><b><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>IT Manager<o:p></o:p></span></b></p>

<p class=MsoNormal><b><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Lane Enterprises<o:p></o:p></span></b></p>

<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'><o:p> </o:p></span></p>

<p class=MsoNormal><b><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Email:</span></b><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>  <a href="mailto:greglane@...14965..."><span
style='color:blue'>greglane@...14965...</span></a><o:p></o:p></span></p>

<p class=MsoNormal><b><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Phone:</span></b><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'> (228)872-2414<o:p></o:p></span></p>

<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>

<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>

<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Joel Esler
[mailto:jesler@...1935...] <br>
<b>Sent:</b> Thursday, September 23, 2010 11:09 AM<br>
<b>To:</b> Greg Lane<br>
<b>Subject:</b> Re: [Snort-users] Snort Configurations<o:p></o:p></span></p>

</div>

<p class=MsoNormal><o:p> </o:p></p>

<p class=MsoNormal>If you don't want to recompile, you should use the
suppressions like we've been telling you.  If you want to recompile, then
you need to use the following compile tags from the VRT snort.conf:<o:p></o:p></p>

<div>

<p class=MsoNormal><o:p> </o:p></p>

</div>

<div>

<p class=MsoNormal style='margin-bottom:12.0pt'>--enable-sourcefire
--enable-reload --enable-targetbased --enable-zlib --enable-ipv6 --enable-gre
--enable-mpls --enable-ppm --enable-perfprofiling<o:p></o:p></p>

<div>

<p class=MsoNormal>On Thu, Sep 23, 2010 at 12:07 PM, Greg Lane <<a
href="mailto:greglane@...14965...">greglane@...14965...</a>>
wrote:<o:p></o:p></p>

<div>

<div>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>So is that fixable?  I would think
that changing the conf file would make the difference there because
doesn’t it follow the guidelines of that file?</span><o:p></o:p></p>

<div>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span
style='font-size:10.5pt;font-family:Consolas;color:#1F497D'>Greg Lane</span></b><o:p></o:p></p>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span
style='font-size:10.5pt;font-family:Consolas;color:#1F497D'>IT Manager</span></b><o:p></o:p></p>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span
style='font-size:10.5pt;font-family:Consolas;color:#1F497D'>Lane Enterprises</span></b><o:p></o:p></p>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:10.5pt;font-family:Consolas;color:#1F497D'> </span><o:p></o:p></p>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span
style='font-size:10.5pt;font-family:Consolas;color:#1F497D'>Email:</span></b><span
style='font-size:10.5pt;font-family:Consolas;color:#1F497D'>  <a
href="mailto:greglane@...14965..." target="_blank">greglane@...14965...</a></span><o:p></o:p></p>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span
style='font-size:10.5pt;font-family:Consolas;color:#1F497D'>Phone:</span></b><span
style='font-size:10.5pt;font-family:Consolas;color:#1F497D'> (228)872-2414</span><o:p></o:p></p>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>

</div>

<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span
style='font-size:10.0pt'>From:</span></b><span style='font-size:10.0pt'> Joel
Esler [mailto:<a href="mailto:jesler@...1935..." target="_blank">jesler@...1935...</a>]
<br>
<b>Sent:</b> Thursday, September 23, 2010 11:04 AM</span><o:p></o:p></p>

<div>

<div>

<p class=MsoNormal><br>
<b>To:</b> Greg Lane<br>
<b>Subject:</b> Re: [Snort-users] Snort Configurations<o:p></o:p></p>

</div>

</div>

</div>

<div>

<div>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Then,
no.  You didn't. That's why commenting out the rules is not working.<o:p></o:p></p>

<div>

<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p>

</div>

<div>

<p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'>J<br>
<br>
On Thu, Sep 23, 2010 at 12:02 PM, Greg Lane <<a
href="mailto:greglane@...14965..." target="_blank">greglane@...14965...</a>>
wrote:<br>
> Here is the command that was used to install Snort<br>
><br>
> Open a command prompt and issue the following commands from the directory<br>
> where you downloaded the Snort<br>
> source code:<br>
> sudo tar zxvf snort2.8.6.tar.gz<br>
> cd snort2.8.6<br>
> sudo ./configure prefix=/usr/local/snort<br>
> sudo make<br>
> sudo make install<br>
> sudo mkdir /var/log/snort<br>
> sudo groupadd snort<br>
> sudo useradd g<br>
> snort snort<br>
> sudo chown snort:snort /var/log/snort<br>
><br>
> Greg Lane<br>
> IT Manager<br>
> Lane Enterprises<br>
><br>
> Email:  <a href="mailto:greglane@...14965..." target="_blank">greglane@...14965...</a><br>
> Phone: (228)872-2414<br>
><br>
><br>
> -----Original Message-----<br>
> From: Joel Esler [mailto:<a href="mailto:jesler@...1935..."
target="_blank">jesler@...1935...</a>]<br>
> Sent: Thursday, September 23, 2010 10:53 AM<br>
> To: Greg Lane<br>
> Cc: <a href="mailto:snort-users@lists.sourceforge.net" target="_blank">snort-users@lists.sourceforge.net</a><br>
> Subject: Re: [Snort-users] Snort Configurations<br>
><br>
> Did you compile Snort with the following tag:<br>
><br>
> --enable-decoder-preprocessor-rules<br>
><br>
> ?<br>
><br>
> On Thu, Sep 23, 2010 at 11:01 AM, Greg Lane <<a
href="mailto:greglane@...14965..." target="_blank">greglane@...14965...</a>><br>
> wrote:<br>
>> How would I know if I'm not using preprocessor rules?  I wouldn't
be<br>
> getting<br>
>> the alert if I wasn't or am I wrong in assuming that? I’m
looking at my<br>
>> snort.conf file and the path to preprocessor rules is correct but I
also<br>
>> found in step 8 looked like this<br>
>><br>
>> # decoder and preprocessor event rules<br>
>> # include $PREPROC_RULE_PATH/preprocessor.rules<br>
>> # include $PREPROC_RULE_PATH/decoder.rules<br>
>> # include $PREPROC_RULE_PATH/sensitive-data.rules<br>
>><br>
>> I then uncommented preprocessor.rules var and it still is giving me
the<br>
>> alert.  I'm sorry if I'm a nuisance but I'm learning this all at
once and<br>
> it<br>
>> seems that it should be not alerting at this point and trying to
figure<br>
> out<br>
>> why.<br>
>><br>
>> Greg Lane<br>
>> IT Manager<br>
>> Lane Enterprises<br>
>><br>
>> Email:  <a href="mailto:greglane@...14965..." target="_blank">greglane@...14965...</a><br>
>> Phone: (228)872-2414<br>
>><br>
>><br>
>> -----Original Message-----<br>
>> From: Joel Esler [mailto:<a href="mailto:jesler@...1935..."
target="_blank">jesler@...1935...</a>]<br>
>> Sent: Thursday, September 23, 2010 9:51 AM<br>
>> To: Greg Lane<br>
>> Subject: Re: [Snort-users] Snort Configurations<br>
>><br>
>> Then you must not be using the preprocessor rules or something.
 It<br>
>> depends on your compile.<br>
>><br>
>> Go with the suppressions, they'll kill it either way.<br>
>><br>
>> J<br>
>><br>
>> On Thu, Sep 23, 2010 at 10:49 AM, Greg Lane <<a
href="mailto:greglane@...14965..." target="_blank">greglane@...14965...</a>><br>
>> wrote:<br>
>>> I did twice.  I killed both the snort and barnyard2 processes
and started<br>
>>> them again in the terminal and read barnyard2's output and the
rule I<br>
>>> commented out in the preprocessor.rules file is still there.
 In fact I<br>
>>> commented out all the http rules in the preprocessor.rules file
and still<br>
>>> getting the alerts.  I looked in the gen-msg file and wonder
if I should<br>
>>> comment those out also but they shouldn't even be getting to that
point<br>
> if<br>
>>> my logic is correct because the rule shouldn't be alerting.<br>
>>><br>
>>> Greg Lane<br>
>>> IT Manager<br>
>>> Lane Enterprises<br>
>>><br>
>>> Email:  <a href="mailto:greglane@...14965..."
target="_blank">greglane@...14965...</a><br>
>>> Phone: (228)872-2414<br>
>>><br>
>>><br>
>>> -----Original Message-----<br>
>>> From: Joel Esler [mailto:<a href="mailto:jesler@...1935..."
target="_blank">jesler@...1935...</a>]<br>
>>> Sent: Thursday, September 23, 2010 9:45 AM<br>
>>> To: Greg Lane<br>
>>> Cc: Alex Tatistcheff; <a
href="mailto:snort-users@lists.sourceforge.net" target="_blank">snort-users@lists.sourceforge.net</a><br>
>>> Subject: Re: [Snort-users] Snort Configurations<br>
>>><br>
>>> "Or you can suppress the output in threshold.conf with
something like:<br>
>>> suppress gen_id 119, sig_id 13"<br>
>>><br>
>>><br>
>>> Make sure you restart Snort after the changes.<br>
>>><br>
>>> J<br>
>>><br>
>>> On Thu, Sep 23, 2010 at 10:22 AM, Greg Lane <<a
href="mailto:greglane@...14965..." target="_blank">greglane@...14965...</a>><br>
>>> wrote:<br>
>>>> I’m commenting out the rules in the preprocessor.rules
file and I’m<br>
> still<br>
>>>> getting the alert.  Gen_id 119  sid 19 long
header.  Why is it still<br>
>>>> alerting?<br>
>>>><br>
>>>><br>
>>>><br>
>>>> Greg Lane<br>
>>>><br>
>>>> IT Manager<br>
>>>><br>
>>>> Lane Enterprises<br>
>>>><br>
>>>><br>
>>>><br>
>>>> Email:  <a href="mailto:greglane@...14965..."
target="_blank">greglane@...14965...</a><br>
>>>><br>
>>>> Phone: (228)872-2414<br>
>>>><br>
>>>><br>
>>>><br>
>>>> From: <a href="mailto:alex.tatistcheff@...11827..."
target="_blank">alex.tatistcheff@...11827...</a> [mailto:<a
href="mailto:alex.tatistcheff@...11827..." target="_blank">alex.tatistcheff@...11827...</a>]
On<br>
>>>> Behalf Of Alex Tatistcheff<br>
>>>> Sent: Wednesday, September 22, 2010 9:46 PM<br>
>>>> To: Greg Lane<br>
>>>> Cc: <a href="mailto:wkitty42@...14940..." target="_blank">wkitty42@...14940...</a>;
<a href="mailto:snort-users@lists.sourceforge.net" target="_blank">snort-users@lists.sourceforge.net</a><br>
>>>><br>
>>>> Subject: Re: [Snort-users] Snort Configurations<br>
>>>><br>
>>>><br>
>>>><br>
>>>> You can suppress the alerting and not affect the normalization
(the<br>
>>>> important part) of the http_inspect preprocessor by commenting
out the<br>
>>> rules<br>
>>>> in the preprocessor.rules file.<br>
>>>><br>
>>>> Or you can suppress the output in threshold.conf with
something like:<br>
>>>> suppress gen_id 119, sig_id 13<br>
>>>><br>
>>>> The first option is what I would recommend.<br>
>>>><br>
>>>> Alex Tatistcheff<br>
>>>> <a href="mailto:alext@...492..." target="_blank">alext@...492...</a><br>
>>>><br>
>>>> The most terrifying words in the English language are,
"I'm from the<br>
>>>> government and I'm here to help." -Ronald Reagan<br>
>>>><br>
>>>> On Wed, Sep 22, 2010 at 1:01 PM, Greg Lane <<a
href="mailto:greglane@...14965..." target="_blank">greglane@...14965...</a>><br>
>>>> wrote:<br>
>>>><br>
>>>> Well there are 3 types of http_inspects that I am getting
mainly.<br>
>>>>  http_inspect: LONG HEADER, http_inspect: NON-RFC DEFINED
CHAR,<br>
>>>> http_inspect: OVERSIZE REQUEST-URI DIRECTORY.<br>
>>>> Everyone of the sources are from inside my network.  Many
of them are to<br>
>>>> amazon EC, <a href="http://quantserve.com" target="_blank">quantserve.com</a>(cookie
related), yahoo, google, facebook, and<br>
>>>> Pandora.  So you can see that most of the traffic is
legit and it isn't<br>
>>>> being triggered from outside the domain.  I'm just not
sure how to cut<br>
>>> down<br>
>>>> on the number of alerts.  When I get that done I will
move on to the<br>
> next<br>
>>>> but I am trying to do this in steps so that I can understand
everything<br>
>>> that<br>
>>>> is going on<br>
>>>><br>
>>>> Greg Lane<br>
>>>> IT Manager<br>
>>>> Lane Enterprises<br>
>>>><br>
>>>> Email:  <a href="mailto:greglane@...14965..."
target="_blank">greglane@...14965...</a><br>
>>>> Phone: (228)872-2414<br>
>>>><br>
>>>> -----Original Message-----<br>
>>>> From: waldo kitty [mailto:<a
href="mailto:wkitty42@...14940..." target="_blank">wkitty42@...14940...</a>]<br>
>>>> Sent: Wednesday, September 22, 2010 1:21 PM<br>
>>>> To: <a href="mailto:snort-users@lists.sourceforge.net"
target="_blank">snort-users@lists.sourceforge.net</a><br>
>>>> Subject: Re: [Snort-users] Snort Configurations<br>
>>>><br>
>>>> On 9/22/2010 12:39, Greg Lane wrote:<br>
>>>>> I’m starting to learn how to tune my Snort install
and it is a slow<br>
>>>>> process.  I<br>
>>>>> have alerts like crazy because I know it needs to be tuned
and I<br>
>>>>> especially have<br>
>>>>> a lot of http_inspect alerts coming up. I’ve been
reading and from what<br>
>> I<br>
>>>>> can<br>
>>>>> gather if you don’t have a websever you may not
really need this in<br>
>>>>> operation or<br>
>>>>> am I wrong?<br>
>>>><br>
>>>> the answer is "it depends"... it depends on if you
want to monitor<br>
>>> outbound<br>
>>>> http<br>
>>>> traffic to possibly catch infestations on your network that
are<br>
> reporting<br>
>>> in<br>
>>>> or<br>
>>>> attacking remote http servers... you might also catch (and be
able to<br>
>>>> prevent)<br>
>>>> internal machines that are being redirected to driveby sites
that would<br>
>>>> (attempt<br>
>>>> to) load them with infestation materials...<br>
>>>><br>
>>>>> If I am wrong then what is the best possible solution for
me to cut<br>
>>>>> down most of the alerts which are false positives so to
speak or aren’t<br>
>>>>> dangerous at all? This will probably be one of many
questions<br>
> concerning<br>
>>>>> configs<br>
>>>>> coming to an email box near you.<br>
>>>><br>
>>>> false positives need to be reported to those who write those
rules so<br>
>> they<br>
>>>> can<br>
>>>> be looked into and adjusted if necessary...<br>
>>>><br>
>>>><br>
>>>><br>
>>><br>
>><br>
>
----------------------------------------------------------------------------<br>
>>> --<br>
>>>> Start uncovering the many advantages of virtual appliances<br>
>>>> and start using them to simplify application deployment and<br>
>>>> accelerate your shift to cloud computing.<br>
>>>> <a href="http://p.sf.net/sfu/novell-sfdev2dev" target="_blank">http://p.sf.net/sfu/novell-sfdev2dev</a><br>
>>>> _______________________________________________<br>
>>>> Snort-users mailing list<br>
>>>> <a href="mailto:Snort-users@lists.sourceforge.net"
target="_blank">Snort-users@lists.sourceforge.net</a><br>
>>>> Go to this URL to change user options or unsubscribe:<br>
>>>> <a
href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
>>>> Snort-users list archive:<br>
>>>> <a
href="http://www.geocrawler.com/redir-sf.php3?list=snort-users" target="_blank">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a><br>
>>>><br>
>>>><br>
>>>><br>
>>><br>
>><br>
>
----------------------------------------------------------------------------<br>
>>> --<br>
>>>> Start uncovering the many advantages of virtual appliances<br>
>>>> and start using them to simplify application deployment and<br>
>>>> accelerate your shift to cloud computing.<br>
>>>> <a href="http://p.sf.net/sfu/novell-sfdev2dev" target="_blank">http://p.sf.net/sfu/novell-sfdev2dev</a><br>
>>>> _______________________________________________<br>
>>>> Snort-users mailing list<br>
>>>> <a href="mailto:Snort-users@lists.sourceforge.net"
target="_blank">Snort-users@lists.sourceforge.net</a><br>
>>>> Go to this URL to change user options or unsubscribe:<br>
>>>> <a
href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
>>>> Snort-users list archive:<br>
>>>> <a
href="http://www.geocrawler.com/redir-sf.php3?list=snort-users" target="_blank">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a><br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>><br>
>><br>
>
----------------------------------------------------------------------------<br>
>>> --<br>
>>>> Nokia and AT&T present the 2010 Calling All
Innovators-North America<br>
>>> contest<br>
>>>> Create new apps & games for the Nokia N8 for consumers in
 U.S. and<br>
>> Canada<br>
>>>> $10 million total in prizes - $4M cash, 500 devices, nearly
$6M in<br>
>>> marketing<br>
>>>> Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to
Ovi Store<br>
>>>> <a href="http://p.sf.net/sfu/nokia-dev2dev" target="_blank">http://p.sf.net/sfu/nokia-dev2dev</a><br>
>>>> _______________________________________________<br>
>>>> Snort-users mailing list<br>
>>>> <a href="mailto:Snort-users@lists.sourceforge.net"
target="_blank">Snort-users@lists.sourceforge.net</a><br>
>>>> Go to this URL to change user options or unsubscribe:<br>
>>>> <a
href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
>>>> Snort-users list archive:<br>
>>>> <a
href="http://www.geocrawler.com/redir-sf.php3?list=snort-users" target="_blank">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a><br>
>>>><br>
>>><br>
>>><br>
>><br>
>><br>
><br>
><o:p></o:p></p>

</div>

</div>

</div>

</div>

</div>

</div>

<p class=MsoNormal><o:p> </o:p></p>

</div>

</div>

</body>

</html>