[Bro] getting raw bytes?

Seth Hall seth at icir.org
Wed Aug 10 09:39:03 PDT 2011

On Aug 10, 2011, at 12:00 PM, Dan Klinedinst wrote:

> But I think this will match from the beginning of the packet, if it
> works at all. I'll test it.

Signatures are implicitly anchored at the beginning of the stream. :)

I could have anchored it myself like you were thinking, but I just chose not to since it's implicit anyway.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list