[Bro] multiple logs for a signature

Robin Sommer robin at icir.org
Wed Nov 29 19:01:49 PST 2006


On Wed, Nov 29, 2006 at 16:14 +0530, Jai Prakash D R wrote:

> I am working on bro-0.9, fedora machine. I want to generate logs using
> signatures the entire communication during a session.

Bro's model is to report each signature at most once per connection.
I don't think that this is easily changeable. 

Can you sketch why in your setup you'd like to have signatures
reported multiple times?

Robin

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the Bro mailing list