[Bro] Adding new signatures
Vern Paxson
vern at icir.org
Tue Jun 27 11:53:39 PDT 2006
> Though my final intention is to make the BRO-IDS support bittorrent
> protocol .
If that's your goal, then you should start quite differently. For Bro,
signatures are a handy add-on, but not the heart of its analysis. Instead,
you should develop a protocol analyzer for Bro's event engine. Often a
good way to develop one of these is to start with an existing one for a
similar protocol and progressively modify it.
Vern
More information about the Bro
mailing list