[Bro-Dev] #457: Signatures only triggering once per connection
Bro Tracker
bro at tracker.bro-ids.org
Thu May 12 04:50:27 PDT 2011
#457: Signatures only triggering once per connection
---------------------+------------------------
Reporter: seth | Owner:
Type: Problem | Status: new
Priority: Normal | Milestone: Bro1.6
Component: Bro | Version: git/master
Keywords: |
---------------------+------------------------
A specific signature looks like it will only trigger once per connection.
This causes problems with the HTTP file type identification if there are
multiple pipelines requests in a connection and multiple of the same file
type are transferred over the connection.
Maybe there needs to be a keyword in the signature language to allow
specific signatures to fire more than once per connection? Eventually
this won't matter when we're doing generic file analysis because the file
type identification will be done differently, but it's causing a problem
for file type identification currently.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/457>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
More information about the bro-dev
mailing list