[Bro-Dev] #947: Incorrect size calculation for SSH failed/successful heuristic

Bro Tracker bro at tracker.bro-ids.org
Wed Feb 20 19:59:48 PST 2013


#947: Incorrect size calculation for SSH failed/successful heuristic
-------------------------+------------------------
  Reporter:  grigorescu  |      Owner:
      Type:  Problem     |     Status:  new
  Priority:  Low         |  Milestone:  Bro2.2
 Component:  Bro         |    Version:  git/master
Resolution:              |   Keywords:
-------------------------+------------------------

Comment (by vern):

 Retransmissions shouldn't affect connection size, which is computed in
 terms of the TCP bytestream rather than anything from packet volume.

 It would be great to have a trace llustrating the problem.  With luck this
 should be pretty much non-sensitive since the logins themselves will all
 be part of the encrypted payload.

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/947#comment:1>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list