[Bro] udp_reply event instead of supposed udp_request event

Vern Paxson vern at icir.org
Fri Feb 11 11:56:14 PST 2005


> What Bro really should do is to look at 
> the packet contents in addition to port numbers in its guessing.

Yes, exactly.

> I don't know if 
> anyone is working on this kind of content-based port selection

I believe some folks at TU Munich are starting to work on this - Robin?

		Vern



More information about the Bro mailing list