Thank you so much for the rules. I actually have searched the board and grabbed as many rules as I could find, but more rules are welcome. Especially for sdbot. That bug sends out a ping storm that drives our core router nuts!

Regarding the Novarg rules you posted, when I issue the snort -c /etc/snort/snort.conf, it complains when it gets to those rules. I guess it doesn't like the classtype and ruleset. I deleted the classtypes and rulesets for the time being. Do you know why snort would be unhappy with those?

Thanks again!!