<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I get you now. I am not aware of an open flow protocol analyzer in Bro.<div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Oct 17, 2016, at 2:45 PM, Hui Lin (Hugo) <<a href="mailto:hlin33@illinois.edu" class="">hlin33@illinois.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Actually, netcontrol is what I thought of as northbound APIs. I actually just wonder whether Bro has analyzer for openflow protocol or not (some refer them as southbound traffics). It not, I probably need to use wireshark to output the pcap and analyze them manually. </div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Mon, Oct 17, 2016 at 2:37 PM, Slagell, Adam J <span dir="ltr" class=""><<a href="mailto:slagell@illinois.edu" target="_blank" class="">slagell@illinois.edu</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class="">Have you looked at the netcontrol framework in Bro, developed by Johanna?<div class=""><br class=""><div class=""><blockquote type="cite" class=""><div class=""><div class="h5"><div class="">On Oct 17, 2016, at 2:24 PM, Hui Lin (Hugo) <<a href="mailto:hlin33@illinois.edu" target="_blank" class="">hlin33@illinois.edu</a>> wrote:</div><br class="m_-2385731506344845318Apple-interchange-newline"></div></div><div class=""><div class=""><div class="h5"><div dir="ltr" class=""><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Hi </div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">My understanding is that Bro has some northbound API to openflow switches or controllers. I am wondering whether any development branch has analyzer of openflow controllers. Just try to see whether I can use Bro to analyze some controller-to-switch traffics. </div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Best,</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br class=""></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Hui</div><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class="m_-2385731506344845318gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class="">Hui Lin<div class="">Ph.D. Candidate (<a href="http://hlin33.web.engr.illinois.edu/" target="_blank" class="">http://hlin33.web.engr.<wbr class="">illinois.edu/</a>) </div><div class="">DEPEND (<a href="http://depend.csl.illinois.edu/" target="_blank" class="">http://depend.csl.illinois.<wbr class="">edu/</a>)<br class="">ECE, Uni. of Illinois at Urbana-Champaign </div><div class=""><br class=""></div></div></div></div></div></div></div></div></div>
______________________________<wbr class="">_________________<br class="">bro-dev mailing list<br class=""><a href="mailto:bro-dev@bro.org" target="_blank" class="">bro-dev@bro.org</a><br class=""><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.icsi.berkeley.edu_mailman_listinfo_bro-2Ddev&d=DQMFaQ&c=8hUWFZcy2Z-Za5rBPlktOQ&r=gMEsgy9kNQo7aTfyIJsOSuw4Z57hfQyz6uV2H4S9PvE&m=6uypPBIs5nv0peW6XK_o8f3Tu4OHNbnBILH4E2KzmI0&s=S1oVBNplwXmgrFjCjOVpo2f7jqaRkA83lof6A3C0K3c&e=" target="_blank" class="">http://mailman.icsi.berkeley.<wbr class="">edu/mailman/listinfo/bro-dev</a><br class=""></div></blockquote></div><br class=""><div class="">
<div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; word-wrap: break-word;" class=""><div class="">------<br class=""><br class="">Adam J. Slagell<br class="">Chief Information Security Officer<br class="">Director, Cybersecurity Division<br class="">National Center for Supercomputing Applications<br class="">University of Illinois at Urbana-Champaign<br class=""><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.slagell.info&d=DQMFaQ&c=8hUWFZcy2Z-Za5rBPlktOQ&r=gMEsgy9kNQo7aTfyIJsOSuw4Z57hfQyz6uV2H4S9PvE&m=6uypPBIs5nv0peW6XK_o8f3Tu4OHNbnBILH4E2KzmI0&s=si3U_XSgz2LTo9UrJ_nkxfh3RIFE1cVuMrTHK3PX6Sk&e=" target="_blank" class="">www.slagell.info</a><br class=""><br class="">"Under the Illinois Freedom of Information Act (FOIA), any written communication to or from University employees regarding University business is a public record and may be subject to public disclosure." <br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""></div></div>
</div>
<br class=""></div></div></blockquote></div><br class=""><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class="">Hui Lin<div class="">Ph.D. Candidate (<a href="http://hlin33.web.engr.illinois.edu/" target="_blank" class="">http://hlin33.web.engr.illinois.edu/</a>) </div><div class="">DEPEND (<a href="http://depend.csl.illinois.edu/" target="_blank" class="">http://depend.csl.illinois.edu/</a>)<br class="">ECE, Uni. of Illinois at Urbana-Champaign </div><div class=""><br class=""></div></div></div></div></div></div>
</div>
</div></blockquote></div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">------<br class=""><br class="">Adam J. Slagell<br class="">Chief Information Security Officer<br class="">Director, Cybersecurity Division<br class="">National Center for Supercomputing Applications<br class="">University of Illinois at Urbana-Champaign<br class=""><a href="http://www.slagell.info" class="">www.slagell.info</a><br class=""><br class="">"Under the Illinois Freedom of Information Act (FOIA), any written communication to or from University employees regarding University business is a public record and may be subject to public disclosure." <br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""></div></div>
</div>
<br class=""></div></body></html>