[Bro] 6to4 Tunnelling
robin at icir.org
Thu May 12 14:16:52 PDT 2011
On Thu, May 12, 2011 at 13:15 -0700, Gregor Maier wrote:
> Actually extracting and parsing the encapsulated v6 traffic is more
> difficult, since the extracted packets would have be injected back into
> Bro's processing above the analyzer trees.
Yeah, the right solution would be to extend the tree structure to
cover IP as well. We should do that at some point anyway.
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro