[Bro-Dev] Bro DCE-RPC Fix for AlterContext and AlterContextResponse Parsers

[Seth Hall]

On 2 Feb 2018, at 9:54, Fernandez, Mark I wrote:

> 5. Bro Issue Tracker
>
> I plan to submit this to Bro Issue Tracker.  Just wanted to give you a 
> heads up here.

Thanks Mark!  Those were probably my comments.  Unfortunately there were 
a number of areas where I just ran out of steam doing investigations 
into why things were happening the way they were so this investigation 
is deeply appreciated.

Do you have PCAPs with ALTER_CONTEXT messages in them?  Because this is 
difficult-to-understand change without seeing actual traffic it would be 
best if you were able to submit the changes along with tests.

Thanks,
   .Seth

--
Seth Hall * Corelight, Inc * www.corelight.com