[Bro] signarture dst-port issue
robin at icir.org
Mon Aug 4 10:52:46 PDT 2008
On Mon, Aug 04, 2008 at 10:33 +0200, Miguel Angel Calvo Moya wrote:
> I am having trouble using signatures on bro. Lets say we have the following signature
Can you send me a small trace with which you see the problem and the
exect command line you're using to start Bro?
> Also, does anybody know whether next release will implement other
> regular expression matching library?
No, we don't have any plans to switch to another regexp library.
> I am trying to update snort2bro to support the snort pcre, however
> it is not a trivial task.
Cool! but yeah, not exactly trivial. :)
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro