credits

关于网络渗透技术的详细讲解

$Id$

Marc Norton     <[e-mail]>
    * Snort 2.0 detection engine
    * Aho-Corasick pattern matchers
    * Wu-Manber pattern matchers
    * sfxhash, sflsq, ipobj libraries
    * Thresholding/suppression
    * Performance monitoring preprocessor

Daniel Roelker  <[e-mail]>
    * Snort 2.0 detection engine
    * HttpInspect detection engine
    * ASN.1 decoder and detection plugin
    * Multi-event queuing, prioritizing, and logging
    * sfPortscan detection engine
    * Snort-inline integration from snort-inline project
    * Performance monitoring preprocessor

Jeremy Hewlett <[e-mail]>
    * CVS and release manager
    * Snort testing 
    * Bug triage
    * Documentation

Sebastian    <[e-mail]>
    * Added TOS decoding and logging

Ron Gula    <[e-mail]>
    * Provided lots of signatures

Mike Borella    <[e-mail]>
    * Made some libpcap code that was actually easy enough to follow along
      in so that even idiots like myself could do something like this.  
      Mike's a cool dude (and he listens to Slayer), check his stuff out
      at www.borella.net

Jed Pickel    <[e-mail]>
    * Sent in the RAW packet decoder routine
    * Database output plugin module
    * XML output plugin module

Chris Sylvain    <[e-mail]>
    * Added HP-UX and S/Linux code, plus the "-x" command line switch.

Damien Daspit    <[e-mail]>
    * Provided the WinPopup code and some other bug fixes, plus helped me
      debug a nasty problem with the rules parser.

Sebastien L.    <[e-mail]>
    * Ideas guy and RPM guru, he's been a help behind the scenes lately.

CyberPsychotic     <[e-mail]>
    * configure.in Sparc alignment updates
    * daemon mode code
    * lots of help debugging the 1.2 release on OpenBSD/Sparc
    * new ftpd buffer overflow rule
    * UnixSock alerting code
    * NULL/Loopback decoder
    * my right hand man in Snort development, constantly working on 
      new stuff and enhancements for the system

Nick Rogness and Jim Forster <[e-mail]> <[e-mail]>
    * lots o' rules, bug reports

Scott McIntyre <[e-mail]>
    * Happy 99 virus rule
    * wacky FBSD bugs and attendant help with said bugs
    * also spotted the otn_tmp NULL bug in 1.3
    * tons of debug info and help!

Ron Snyder <[e-mail]>
    * IP address negation operator code
    * Bug hunter extrordinaire

Jonathan Emery <[e-mail]>
    * Ran Purify on the Snort source and tracked down some nasty buggage

Aaron Smith <[e-mail]>
    * non-promiscuous mode patch
    * logging code streamlining

Dug Song & Torbjorn Wictorin <[e-mail]> <[e-mail]> 
    * Torbjorn spotted it first, but Dug sent in a kick ass bug report so 
      they both get credit for finding the otn_tmp NULL bug in LogPkt.

Max Vision <[e-mail]>
    * Ideas, debug help, lots of rules

Dragos Ruiu <[e-mail]>
    * Ideas guy, keeps me honest :)
    * Author of defrag preprocessor

Colin Haxton <[e-mail]>
    * Timestamp bugfix, debug help

Worm5er <[e-mail]>
    * Master Debugger, he's always got the best bugs! :)

Lance Spitzner <[e-mail]>
    * Thank Lance for the session keyword!
    * Lots of debug help, suggestions

Christian Lademann <[e-mail]>
    * The Man!  Added the rules file variable and include code.  This man
      should have a place in every Snort user's heart. ;)
    * Added the ISDN for Linux support/decoders

Christian Hammers <[e-mail]>
    * Maintains the Debian distro of Snort, sends me nice bug reports.

Michael Henry <[e-mail]>
    * Sent in the URL decoder that eventually became the http_decode
      preprocessor

Bob Beck <[e-mail]>
    * Sent in a few security patches, some advice 

Sebastian <[e-mail]>
    * Linux PPC testing.
    * Great help with tracking down `loopback failure' problem.

Patrick Mullen <[e-mail]>
    * snort portscan preprocessor.
    * great helper on the project.

Herb Commodore <[e-mail]>
    * `--with-libpcap' fixes to configure.in.

John Wilson <[e-mail]>
    * New implementation of insensitive pattern match code.

Mike Caughran <[e-mail]>
    * Great help with porting snort to AIX platform.

Astaroth <[e-mail]>
    * Added Tru64/Alpha support.

Daniel Monjar <[e-mail]>
    * More Tru64/Alpha diffs.

Ralf Hildebrandt <[e-mail]>
    * HP-UX debugger and ombudsman.

Stuart Staniford-Chen <[e-mail]>
    * Ideas guy, he's been bouncing around ideas for better output
      classification in Snort.
    * Wrote snortsnarf.pl, a CGI/HTML program for organizing Snort output.

Yen-Ming Chen <[e-mail]>
    * Wrote the excellent snort-stat.pl statistical analysis script for 
      Snort alerts.
    * Wrote a nice PHP front-end for the Snort alerting mechanism.

Erich Meier <[e-mail]>
    * Lots of help debugging debugging!
    * ip tos plugin.

Denis Ducamp <[e-mail]>
    * Solaris debugging and patching.

Boa <[e-mail]>
    * Great help with the addition of Token Ring support to Snort.

Anthony Stevens <[e-mail]>
    * Contributed the Guardian firewall response system to Snort.

Andrew R. Baker <[e-mail]>
    * Contributed the snort-sort alert analysis script.
    * Tweaked various other Snort analysis scripts.
    * Added variable level alert support, officially joining the ranks
      of the bad-asses :)

J Cheesman <[e-mail]>
    * Enhanced the PID logging code to be more robust.

"Mark Hindess" <[e-mail]>
    * Added the RPC application layer detection plugin

Dave Wreski <[e-mail]>
    * Provided support and help diagnosing problems with the 1.6.2
          config scripts
    * Snort-HOWTO paper.      

Bo <[e-mail]>
    * Provided fixes for my idiotic configure.in antics in version 1.6.2
 
Peter Weinberger <[e-mail]>
    * Added code to fill in full transport protocol names

Dave Dittrich <[e-mail]>
    * Provided a little patch to fix daemon mode alert filenames

Christopher Cramer <[e-mail]>
    * Author of the TCP stream preprocessor! (spp_tcp_stream)

Joe Stewart <[e-mail]>
    * Added UNICODE and NULL byte attack detection to http_decode preproc

Thomas Zajic <[e-mail]>
    * Provided some sanity check fixes for the PID file

Jason Ish <[e-mail]>
    * Cleaned up the plugin template files

Paul Herman <[e-mail]>
    * Contributed a patch to clean up sloppy strlen/strncpy interactions

Todd Lewis <[e-mail]>
    * Big new addition to the project, idea/code generator extrordinaire :)

Phil Wood <[e-mail]>
    * Master debugger, got the IP/bidirectional code back on its feet after
      the addition of IP lists
    * Numerous other bugpointers, tweaks etc.
    * pointed out signature logic errors

Dr SuSE <[e-mail]>
    * Helps out with docs, answering questions on the mailing list, etc.

Joe McAlerney <[e-mail]>
    * sp_reference plugin, constant helper on the project

James Hoagland <[e-mail]>
    * SPADE statiscal anomaly detection plugin, lots of other help and 
      advice

Maciek Szarpak <[e-mail]>
    * Author of the react plugin

Paul Ritchey <[e-mail]>
    * Provided the -y year printout command line switch code

Eugene Tsyrklevich <[e-mail]>
    * Added smalloc.h and fatal.h
    * patches for stupidity in various files
    * strl* functions/patches. A bunch of of other minor tweaks.
    * ideas for new debugging code.

Markus De Shon <[e-mail]> & Jon Ramsey <[e-mail]>
    * tracked down tricky false positive condition in sp_pattern_match

Koji Shikata <[e-mail]>
    * spp_http preprocessor patch which allows to catch broken unicode 
      (which still works on IIS 4.x servers).

Achim Gsell <[e-mail]>
    * some pointers/fixes on problems in spp_defrag.c piece.

Tomtom <[e-mail]>
    * Added PPPoE decoder

Chris Green <[e-mail]>
    * documentation
    * testing on #snort
    * code maintenance
    * flow-portscan
    * flow

Bill Gercken <[e-mail]>
    * lots of patches and testing on his busy network

HD Moore <[e-mail]>
    * testing, keeping me honest :)

Matt Scarborough <[e-mail]>
    * another good tester/bug reporter

Jeff Nathan <[e-mail]>
    * added spp_arpcheck code, watches for ARP stuff, RTFS
    * updated man page for 1.8

Brian Caswell <[e-mail]>
    * Snort Rules Nazi, keeps the rules trains running on time
    * wrote spo_csv
    * constant companion on #snort

Glenn Mansfield Keeni <[e-mail]>    
    * Added SNMP output support plugin for Snort, cool!

Chris Reid <[e-mail]>
    * win32 support patches.
    * ms-sql support for spo_database
    * create_mssql script
    * other minor fixes/tweaks

Robert Hughes <[e-mail]>
    * rules fixes

Jimmy Stags 
    * pointed out duplicate signatures
    
Zeno <[e-mail]>
    * a number of signatures included in web-attacks.rules

Ryan Russell <[e-mail]>
    * a zillion signature corrections.  

Mike Davis <[e-mail]>
    * original win32 port

Ofir Arkin <[e-mail]>
    * Helped with cleanup and correction of ICMP decoder subsystem

Fabio Bastiglia Oliva <[e-mail]>    
    * Rules cleanup!