[Bro] Bro and asymmetric routing

Adayadil Thomas adayadil.thomas at gmail.com
Mon Oct 30 13:44:42 PST 2006

Hello All

I have a question about asymmetric routing and Bro IDS

Consider a situation where a traffic to and from an organization takes
different routes and the IDS is deployed where only one directional of
the conversation can be monitored (either client to server OR server
to client).
In such a situation does the TCP analysis of Bro work ? or does it
need to see both sides of the conversation ?

Thanks for the reply.

More information about the Bro mailing list