[Bro] Problem in using 'http-request-header' in Signatures

Robin Sommer robin at icir.org
Wed Sep 27 09:37:56 PDT 2006

On Wed, Sep 27, 2006 at 10:17 +0530, you wrote:

> Thats good. Can you suggest me how to add it?

If you give me a few days, I'll take a look at it. 

However, if you really want to give it a try yourself (which is
always appreciated!), grep for "Rule::HTTP" across the source to see
how it is done for HTTP URLs (the "http" signature keyword).
http-request-header can be added in a similar fashion. 


Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
ICIR/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list