about class Dcitionary
vern at icir.org
Sat Sep 28 20:42:21 PDT 2002
> As you kownn, snort works on packet data, while Bro works on connection
Bro also has a signature engine that can read Snort rules, per the
> want to know how to use Bro to save all the connection to dist file.
I don't quite know what you mean. Bro writes connection summaries to
stdout if you load tcp.bro (or the usual load of mt.bro). It also can
write a tcpdump packet trace file if you specify -w file.
More information about the Bro