simple pattern question

Terry Barker Terry.Barker at sas.com
Wed Jul 14 09:46:15 PDT 2004


Robin,
	Thanks for the reply.
	I had tried that. Still no luck. 
	By the way, I didn't mention that I included the policy script ntp.bro on the command line when invoking bro.
	Terry

> -----Original Message-----
> From: Robin Sommer [mailto:sommer at in.tum.de]
> Sent: Tuesday, July 13, 2004 2:43 AM
> To: Terry Barker
> Cc: bro at listserv.lbl.gov
> Subject: Re: simple pattern question
> 
> 
> On Mon, Jul 12, 2004 at 13:18 -0400, you wrote:
> 
> > payload /version/
> 
> Try using /.*version/. The regexp is matched starting with the first
> byte of the payload.
> 
> Robin
> 
> --
> Robin Sommer * Room        01.08.055 * www.net.in.tum.de
> TU Muenchen  * Phone (089) 289-18006 *  sommer at in.tum.de




More information about the Bro mailing list