[Bro] multiple logs for a signature
robin at icir.org
Wed Nov 29 19:01:49 PST 2006
On Wed, Nov 29, 2006 at 16:14 +0530, Jai Prakash D R wrote:
> I am working on bro-0.9, fedora machine. I want to generate logs using
> signatures the entire communication during a session.
Bro's model is to report each signature at most once per connection.
I don't think that this is easily changeable.
Can you sketch why in your setup you'd like to have signatures
reported multiple times?
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org
LBNL/ICSI * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro