[Bro] SMTP Analyzer

Vern Paxson vern at icir.org
Thu Oct 11 18:01:19 PDT 2007

> since few weeks I'm watching bruteforce attacks on SMTP AUTH.

Could you send a trace of one of these attacks?  That would be the easiest
way for us to figure out whether the necessary events are already available,
or if the event engine would need any extension to handle this.


More information about the Bro mailing list