[Bro] Several protosig questions
jlay at slave-tothe-box.net
Wed Oct 19 17:44:32 PDT 2016
On Wed, 2016-10-19 at 17:28 -0700, Robin Sommer wrote:
> On Mon, Oct 17, 2016 at 15:08 -0600, you wrote:
> > Included! Sigs below (in 2.4.1 order mattered..I think last
> > matched
> > gets the protosig tag, but I've swapped these around with the same
> > results)..in either case only ntp matches, not ntp_apple.
> So both the problems turn out to be bugs: dst-ip is indeed not
> with IPv4 CIDR ranges, and payload-size is behaving oddly with (I
> believe only) UDP. I have patches for both in git branch
> topic/robin/sig-fixes, could you give that a try?
Can do....those patches in the bro git repository or somewhere else? I
wasn't able to find them on github. Thanks for the work Robin!
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro