Snort Contact Information / Credits

Marty Roesch -  <> Rule Contributors:
Louis Bertrand for updates to the Ports listing / new additions to the list
Paul Bobby for many rule updates, additions, and verification of current rulesets
Piotr Bulczak for the update on the Prosiak Backdoor ports / additional ports to watch
CyberPsychotic - Initial distribution rules 
Jim Forster - - Initial distribution rules - rules
Ghost23 - Initial distribution rules
Ron Gula - - Initial distribution rules
Alan Hood for extensive work on updating the IDS and CVE rule references
Jonathan Lang for updates to (all) rules, and his 'testing' for new sets
Andreas Lindenblatt for updates on current ruleset falses and new set verification
Martin Markgraf  - Initial distribution rules
Bill Marquette for rule updates, beta testing the new sets, and some great ideas!
Scott McIntyre  - Initial distribution rules
Fabio Bastiglia Oliva - <>> - Updated Backdoor Rules
B. Pfitzinger for info about SANS requests for logs of scans on unfamiliar ports
Nick Rogness - - Initial distribution rules 
Max Vision - whitehats - Initial distribution rules / ArachNIDS
JP Vossen for a HUGE update to the 'ports' listing and database!
Snort Core and Add-On Files:

-> http-decode by Marty Roesch & John Wilson
-> portscan by Patrick Mullen
-> ip_defrag by Dragos Ruiu
-> SPADE by James Hoagland
-> traffic <in beta> by Colin Haxton
-> tcp_stream <in beta> by Chris Cramer

Detection Plugins:
Most are by Marty Roesch, some contributions include..
-> tcp_flags was modified by John Good to accept limited boolean logic
-> sp_psize by Christopher Cramer
-> sp_pattern_match was largely improved by John Wilson
-> sp_ip_tos by Erich Meier
-> sp_reference by Joe McAlerney
-> sp_react by Maciej Szarpak

Output plugins:
-> alert_fast by Andrew Baker 
-> alert_full by Andrew Baker 
-> alert_smb by Andrew Baker 
-> database by Jed Pickel 
-> XML by Jed Pickel & Roman Danyliw 

Add-on programs:
-> 5n0r7.c by Michel "MaXX" Kaempf 
-> Guardian by Anthony Stevens 
-> by Sten Kalenda 
-> create_mysql by Jed Pickel 
-> create_postgresql by Jed Pickel 
-> by Andrew Baker 
-> snort2html by Dan Swan 
-> by Yen-Ming Chen 
-> snortlog by Angelos Karageorgiou 
-> by Stuart Staniford-Chen 
-> snortwatch by Yves Perrenoud 

Snort Webpage Thanks:
Jim Forster for Webpage updates - rule and port databases
Fabio Oliva for work involving database integration and updates
Tiffany Forster for help with the ongoing database work (And allowing me to backdoor her system for rule development)  :P
Nick Rogness for the rule additions, mail archive, and scripts
Pete Stapley for database work and changes
RFP for beating the databases senseless during the testing phase
Andy Thompson for site updates / database work
The Genocide2600 Group for the usual mass of input (
RapidNet, Inc. for drive space and bandwidth

Special Thanks to Al & Jean Trucano for all the ongoing support!

Contact Information:
Andrew Baker <>
Christopher Cramer<>
Colin Haxton <>
CyberPsychotic <>
Dequeue <>
Doxavg <>
Dr SuSE <>
Dragos Ruiu <>
Fabio Bastiglia Oliva <>
Genocide <>
Ghost23 <>
Jed Pickel <>
James Hoagland <>
Jason Ish <>
Jim Forster <>
Joe Stewart <>
Joe McAlerney <>
John Wilson<>
JP Vossen <>
Maciek Szarpak <>
Martin Markgraf <>
Marty Roesch <>
Max Vision <>
Mistress <>
Nick Rogness <
Patrick Mullen <Patrick.Mullen@GD-CS.COM>
Paul Herman <>
Phil Wood <>
Ron Gula <>
Scott McIntyre <>
Tatooman <>
The Weasel <>
Thomas Zajic <>
Tiffany Forster <>
Todd Lewis <>
Yen Ming Chen <>

Web Page problems or questions - Ruleset additions or questions -