[Bro] SSL_SessConIncon

Robin Sommer robin at icir.org
Thu May 7 13:47:43 PDT 2009


On Wed, May 06, 2009 at 12:36 -0600, you wrote:

> when a current SSL connection does not match either the version or
> cipher of a previous matching connection, and bro has inferred that the
> SSL connection was cached and reused.  Is this a known bug in ssl.bro?

I don't think I have heard about this one. Could you file a ticket
with out tracker, if possible with attaching a trace of one
connection triggering such an alarm? Thanks.

Robin

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the Bro mailing list