[Bro] Some questions and Netflow.
robin at icir.org
Tue Jan 31 16:44:18 PST 2006
On Mon, Jan 30, 2006 at 08:41 -0500, Jean-Philippe Luiggi wrote:
> - Using Bro as a Netflow concentrator.
> - Using a dedicated tool to capture the flows and then use "Bro" to inspect data.
Both approaches seem to be reasonable. There has been some
discussion of integrating NetFlow into Bro for some time now but, as
far as I'm aware of, nothing concrete has materialized yet. It's on
our radar though and indeed part of a planned future project (with
no concrete time schedule yet though).
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org
ICIR/ICSI * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro