[Bro] Signatur match issue with Bro 1.2.1

[Robin Sommer]

On Fri, Apr 20, 2007 at 12:10 +0530, you wrote:

> handshake packets), but i am curious to know why the signatures with the
> line "ip-proto == tcp" will not work for the asymmetric case.

That's indeed an interesting difference. Can you send me the two
traces? 

Robin

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org