[Bro] Clarification reg signatures

Robin Sommer robin at icir.org
Thu Mar 1 21:23:53 PST 2007

On Fri, Mar 02, 2007 at 09:45 +0530, Jaya Dhanesh wrote:

> 	payload/.{0,3}\x0a\x2a\x17/

That should actually work. Can you send me the packets of a
connection which should match this signature and the exact
command-line you are using to start Bro?

> I also saw patterns like payload /{4}reg-exp/ in signatures file. 

That looks like a syntax error and should not compile. Where did you
see it?


Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list