[Bro] login_success event

Vern Paxson vern at icir.org
Thu Apr 11 22:52:03 PDT 2013

> Is someone has already successfully make the login_success (or 
> login_failure) event work?
> The event always returns : user= <none>, password=<timeout>.

(1) What version of Bro are you running?

(2) Do you really have plaintext telnet/rlogin traffic?  (That's what the
    analyzer focuses on.  It's very old.)


More information about the Bro mailing list