[Bro-Dev] #457: Signatures only triggering once per connection

Bro Tracker bro at tracker.bro-ids.org
Thu May 12 04:50:27 PDT 2011


#457: Signatures only triggering once per connection
---------------------+------------------------
 Reporter:  seth     |      Owner:
     Type:  Problem  |     Status:  new
 Priority:  Normal   |  Milestone:  Bro1.6
Component:  Bro      |    Version:  git/master
 Keywords:           |
---------------------+------------------------
 A specific signature looks like it will only trigger once per connection.
 This causes problems with the HTTP file type identification if there are
 multiple pipelines requests in a connection and multiple of the same file
 type are transferred over the connection.

 Maybe there needs to be a keyword in the signature language to allow
 specific signatures to fire more than once per connection?  Eventually
 this won't matter when we're doing generic file analysis because the file
 type identification will be done differently, but it's causing a problem
 for file type identification currently.

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/457>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list