[Bro] login_success event

nicolas.retrain at cea.fr nicolas.retrain at cea.fr
Wed Apr 10 00:34:36 PDT 2013


Hi,
I apologize in advance for the rough English.

Is someone has already successfully make the login_success (or 
login_failure) event work?
The event always returns : user= <none>, password=<timeout>.
Am i forgetting something?


I have take a look into the Analyzer code.
It seems that when the Login Analyzer get the first server command :
"OpenBSD/i386 (oof)  (ttyp2)"
It tries to parse it like an authentication, and go in a 
LOGIN_STATE_CONFUSED.
Then, when the client is authenticating the analyzer does not see it.

I also asked for a tracker account, but have no return yet. I just want 
to share an Imap analyzer.

Best regards,
Nicolas



More information about the Bro mailing list