[Bro] One-way TCP session to handle HTTP requests only

Seth Hall seth at icir.org
Wed Mar 25 11:27:13 PDT 2015

> On Mar 25, 2015, at 1:11 PM, Rovnov Pavel <provnov at solidex.by> wrote:
> Does anyone know how to switch Bro into asymmetric mode? At least can I disable notices that need 2-way session?

Unfortunately at this time, we don’t put much attention to asymmetric traffic analysis.  This is something I’ve been wanting to do for a long time, but it hasn’t bubbled up high enough on the priority list yet.  

Any results you get from asymmetric traffic processing are coincidental, we don’t have any tests or anything that validate that Bro works in any particular scenario with asymmetric traffic.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list