[Bro-Dev] Portmapper logging

[Seth Hall]

On Dec 6, 2010, at 3:44 PM, Vern Paxson wrote:

> I find that very surprising.  At LBL, the conn logs are often of crucial
> forensic significance.  One form of this comes up when an attacker sets
> up a backdoor on port XYZ, which will only appear in the conn logs.  Another
> is when the activity involves a service for which there's no Bro analyzer.

Netflow logs. :)  OSU being OSU, we tried to carefully maintain our archive of netflow.

  .Seth