icmp and bro

Paul Howell grue at merit.edu
Mon Dec 7 08:35:13 PST 1998


Before I get too far into this, I wanted check and see if anyone
else is actively working on adding ICMP to bro?

I've started working on it and hope to be done pretty soon (famous
last words!).  Maybe I'm naive, but it doesn't look too hard.

NetSessions::NextPacket() looks like the best place to start.

I've got some very simple ICMP recognition code in place.  I haven't
looked at fragments or reassembly yet.


< paul

More information about the Bro mailing list