[Bro-Dev] binpac usage of &length = -1

[Robin Sommer]

On Sun, Feb 10, 2013 at 15:48 -0600, you wrote:

> Unfortunately, yes, you needed the &length field. Otherwise:
> 
> /home/****/bro/src/dnp3-protocol.pac:42: error : cannot handle incremental
> input

Too bad, that sounds like a case it should be able to support rather
easily.

> Then the interesting question is when binpac can handle incremental input?

I have no idea ... It might actually be worth looking at the code and
see where it stumbles. And/or try the dce_rpc approach as we
discussed.

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org