[Bro] question about ssl analyzer
jbabbin at comcast.net
jbabbin at comcast.net
Tue Feb 21 18:19:50 PST 2006
List,
I have a question about the SSL analyzer and the ssl.bro policy file. I'm trying to use this policy to track ssl certificates across a link. However, this policy seems to be broken.
Upon starting bro 1.0 with ssl.bro enabled I get
line 1: warning: event handlers never invoked:
line 1: warning: account_tried
line 1: warning: ssl_ciphersuite_seen
after the first ssl connection or sometimes the second... bro seg faults with no core or debugging information. Also I have recompiled bro with debugging enabled and retried it with no luck as well.
Lastly, I have turned almost everything off in the policy file just to check if thats the issue as well.
Anyone been able to run the ssl analyzer successfully?
Thanks,
Jake Babbin
More information about the Bro
mailing list