[Bro-Dev] Bro DCE-RPC Fix for AlterContext and AlterContextResponse Parsers

Seth Hall seth at corelight.com
Sat Feb 3 19:46:07 PST 2018

On 2 Feb 2018, at 9:54, Fernandez, Mark I wrote:

> 5. Bro Issue Tracker
> I plan to submit this to Bro Issue Tracker.  Just wanted to give you a 
> heads up here.

Thanks Mark!  Those were probably my comments.  Unfortunately there were 
a number of areas where I just ran out of steam doing investigations 
into why things were happening the way they were so this investigation 
is deeply appreciated.

Do you have PCAPs with ALTER_CONTEXT messages in them?  Because this is 
difficult-to-understand change without seeing actual traffic it would be 
best if you were able to submit the changes along with tests.


Seth Hall * Corelight, Inc * www.corelight.com

More information about the bro-dev mailing list