[Bro-Dev] #354: Allow analyser to process partial HTTP connections.

Bro Tracker bro at tracker.icir.org
Wed Jan 19 09:04:36 PST 2011


#354: Allow analyser to process partial HTTP connections.
------------------------------+-----------------
  Reporter:  sridhar.basam    |      Owner:
      Type:  Feature Request  |     Status:  new
  Priority:  Normal           |  Milestone:
 Component:  Bro              |    Version:
Resolution:                   |   Keywords:
------------------------------+-----------------

Comment (by seth):

 From Sridhar:
 > I have applications which use a persistant HTTP connections to
 > talk to upstream services. These connections live for a really long
 > time, thousands/tens of thousands of requests on a single tcp
 > connection. I use bro to analyse http request and replies for these
 > applications.  I need the ability to run the analyser for these
 > partial connections in the pcap file.

 Ah!  I totally understand your frustration with this behavior then.  We'll
 make sure and discuss this for the 1.6 release.  It's definitely not going
 to make it into a 1.5.x release for the reasons that Robin mentioned
 previously.

 Thanks for following up.  That's a great example for this ticket.

   .Seth

-- 
Ticket URL: <http://tracker.icir.org/bro/ticket/354#comment:2>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list