[Bro] Signature payload matching

Robin Sommer robin at icir.org
Thu Jul 7 08:20:03 PDT 2011


On Thu, Jul 07, 2011 at 09:23 +0200, you wrote:

> Once a signature has been written, compiled and matched against a traffic. I
> noticed that sometimes there are entries in signatures.log and notice.log,
> sometimes there is only entries in notice.log.

Can you send an example including the entries in the logs and the
signatures?

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the Bro mailing list