[Bro] Detecting heartbleed activity

James Lay jlay at slave-tothe-box.net
Thu Apr 10 05:24:44 PDT 2014

So...I'd like to be able to see if any heartbleed activity was happening
before everyone knew about it.  I'm thinking I'd see this in the
conn.log with data leaving the server.  Any thoughts or pointers we
could use to check?  Thanks all.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140410/95136359/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 490 bytes
Desc: This is a digitally signed message part
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140410/95136359/attachment.bin 

More information about the Bro mailing list