[Bro] Notice on duration

James Lay jlay at slave-tothe-box.net
Fri Mar 18 14:47:49 PDT 2016

Hey all,

I've been tasked with seeing about getting an alert of some kind when a 
session (tcp/udp/icmp) lasts longer then a certain time.  Is this 
something well suited for bro, or should I go looking at something like 
ntop-ng instead?  Thank you.


More information about the Bro mailing list