[Bro-Dev] Bro DCE-RPC Fix for AlterContext and AlterContextResponse Parsers
seth at corelight.com
Thu Feb 8 10:55:25 PST 2018
Cool, thanks Mark!
On 8 Feb 2018, at 7:16, Fernandez, Mark I wrote:
> Hi Seth,
> Yes, I have a pcap containing the ALTER_CONTEXT req/resp packets. I
> will start working on the bug fix and submit to BIT, with pcap and
> test script, hopefully soon.
> -----Original Message-----
> From: Seth Hall [mailto:seth at corelight.com]
> Sent: Saturday, February 3, 2018 10:46 PM
> To: Fernandez, Mark I <mfernandez at mitre.org>
> Cc: bro-dev at bro.org
> Subject: Re: [Bro-Dev] Bro DCE-RPC Fix for AlterContext and
> AlterContextResponse Parsers
> On 2 Feb 2018, at 9:54, Fernandez, Mark I wrote:
>> 5. Bro Issue Tracker
>> I plan to submit this to Bro Issue Tracker. Just wanted to give you
>> heads up here.
> Thanks Mark! Those were probably my comments. Unfortunately there
> a number of areas where I just ran out of steam doing investigations
> into why things were happening the way they were so this investigation
> is deeply appreciated.
> Do you have PCAPs with ALTER_CONTEXT messages in them? Because this
> difficult-to-understand change without seeing actual traffic it would
> best if you were able to submit the changes along with tests.
> Seth Hall * Corelight, Inc * www.corelight.com
Seth Hall * Corelight, Inc * www.corelight.com
More information about the bro-dev