<div dir="ltr">I'm not sure I agree without additional context. ICMP exfil is a known technique. Wouldn't you want to know if all of a sudden, you started seeing gigs of ICMP? Or is there some other limitation that would make detecting this problematic?<div><br></div><div>What I would recommend instead is simply adding the protocols to the ports. So, instead of "top ports: 53, 80, 443, 8" you would see: "top ports: 53/udp, 80/tcp, 443/tcp, 8/icmp"</div><div><br></div><div>Would this be sufficient to solve the ICMP/port number confusion?</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Apr 26, 2016 at 8:07 AM, Adam Slagell (JIRA) <span dir="ltr"><<a href="mailto:jira@bro-tracker.atlassian.net" target="_blank">jira@bro-tracker.atlassian.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
[ <a href="https://bro-tracker.atlassian.net/browse/BIT-1571?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=25900#comment-25900" rel="noreferrer" target="_blank">https://bro-tracker.atlassian.net/browse/BIT-1571?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=25900#comment-25900</a> ]<br>
<span class=""><br>
Adam Slagell commented on BIT-1571:<br>
-----------------------------------<br>
<br>
</span>Talking with Seth, he agrees that it probably just makes more sense to leave ICMP out of the connection summaries.<br>
<span class=""><br>
> Connection summaries w/ IPv6 have poor readabiity<br>
> -------------------------------------------------<br>
><br>
> Key: BIT-1571<br>
> URL: <a href="https://bro-tracker.atlassian.net/browse/BIT-1571" rel="noreferrer" target="_blank">https://bro-tracker.atlassian.net/browse/BIT-1571</a><br>
> Project: Bro Issue Tracker<br>
> Issue Type: Improvement<br>
> Components: BroControl<br>
> Affects Versions: 2.4<br>
> Reporter: Adam Slagell<br>
> Assignee: Daniel Thayer<br>
> Priority: Low<br>
> Fix For: 2,5<br>
><br>
> Attachments: [Bro] Connection summary from 15_53_27-16_00_00.txt<br>
><br>
><br>
> The variable length of IPv6 and being mixed with IPv4 causes alignment issues with the white space in the connection summary emails.<br>
<br>
<br>
<br>
--<br>
This message was sent by Atlassian JIRA<br>
</span>(v1000.5.0#72002)<br>
<div class="HOEnZb"><div class="h5">_______________________________________________<br>
bro-dev mailing list<br>
<a href="mailto:bro-dev@bro.org">bro-dev@bro.org</a><br>
<a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev" rel="noreferrer" target="_blank">http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev</a><br>
</div></div></blockquote></div><br></div>