[Bro] URG Flag

Vern Paxson vern at icir.org
Wed Jan 12 11:19:30 PST 2005

> One way is through event tcp_packet:
> ...
> But please note that it requires a per-TCP-packet event and thus only 
> works for low volume traffic.

Yes.  And, more generally, this sort of low-level analysis is not what Bro
is designed for.  If all you want to do is count URG packets, a simple
tcpdump filter is much more efficient.


More information about the Bro mailing list