[Bro] Bro 2.4.1 and issue with smtp-embedded-url-bloom.bro
jlay at slave-tothe-box.net
Wed Mar 30 16:54:37 PDT 2016
On Wed, 2016-03-30 at 15:04 +0000, Stephen Castellarin wrote:
> Hi all,
> I've set up a Bro instance to test out URL extraction from SMTP, using
> the smtp-embedded-url-bloom.bro scripts. For the most part the
> extract/logging is working, but many times I'll find that the host and
> url logged will be truncated. As an example I'd see one email listed
> that has 20 links extracted, but one log entry would have host name as
> "award" with the url as "http://award". The remaining URLs for that
> email look to be extracted correctly.
> Has anyone else noticed this issue?
> Bro mailing list
> bro at bro-ids.org
Yep...I suspect emails that are quoted-printable emails fall victim to
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro