[Bro] create team for update snort2bro script signature ?
robin at icir.org
Sun Nov 9 22:32:21 PST 2008
On Fri, Nov 07, 2008 at 06:56 +0100, you wrote:
> bro-1.4/scripts/s2b/bin/s2b.pl ?
Ah, I see. That is actually a wrapper around the Python snort2bro
which does some stuff on top of it.
> do you known if it is possible adding this features ?
Not sure. These options, iirc, are using packet-semantics which are
hard to emulate in Bro's stream-model. They might be some
approximation though which works suffiently well, don't know.
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro