simple pattern question
Terry.Barker at sas.com
Wed Jul 14 09:46:15 PDT 2004
Thanks for the reply.
I had tried that. Still no luck.
By the way, I didn't mention that I included the policy script ntp.bro on the command line when invoking bro.
> -----Original Message-----
> From: Robin Sommer [mailto:sommer at in.tum.de]
> Sent: Tuesday, July 13, 2004 2:43 AM
> To: Terry Barker
> Cc: bro at listserv.lbl.gov
> Subject: Re: simple pattern question
> On Mon, Jul 12, 2004 at 13:18 -0400, you wrote:
> > payload /version/
> Try using /.*version/. The regexp is matched starting with the first
> byte of the payload.
> Robin Sommer * Room 01.08.055 * www.net.in.tum.de
> TU Muenchen * Phone (089) 289-18006 * sommer at in.tum.de
More information about the Bro