[Bro] Adding new signatures
robin at icir.org
Tue Jun 27 12:54:09 PDT 2006
On Tue, Jun 27, 2006 at 11:53 -0700, Vern Paxson wrote:
> If that's your goal, then you should start quite differently. For Bro,
> signatures are a handy add-on, but not the heart of its analysis.
Though they can be used to detect the protocol in the first place,
to then trigger further analysis via a protocol-specific analyzer.
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org
ICIR/ICSI * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro