[Bro] Question about HTTP policy capture filters

Jake Babbin jbabbin at comcast.net
Mon Jun 20 14:49:58 PDT 2005

I am trying to get bro (9a8) to capture http events that are not coming over port 80/tcp as well as several other ports. 

 "not tcp dst port 80 and not tcp dst port 8080" 

However, bro seems to be only reading one filter and not the second part of filter.  

Jake Babbin 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20050620/df22722c/attachment.html 

More information about the Bro mailing list