[Bro] TCP normalization and reassembly decision

Vern Paxson vern at berkeley.edu
Tue Nov 14 10:53:14 PST 2017

> It also explains that at least the rule 3 in Vern's paper cannot be
> implemented since it has to be operated in in-line mode. But how the first
> two rules?

That paper focuses on in-line network processing: none of the rules in
it help thwart evasion for passive monitoring.


More information about the Bro mailing list