[Bro] Question about HTTP policy capture filters

Jake Babbin jbabbin at comcast.net
Mon Jun 20 14:49:58 PDT 2005


List: 
I am trying to get bro (9a8) to capture http events that are not coming over port 80/tcp as well as several other ports. 

http-request.bro: 
 "not tcp dst port 80 and not tcp dst port 8080" 

However, bro seems to be only reading one filter and not the second part of filter.  

Thoughts,
Jake Babbin 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20050620/df22722c/attachment.html 


More information about the Bro mailing list