[Bro] three things

[Robin Sommer]

On Mon, Feb 05, 2007 at 11:42 -0600, Mike Dopheide wrote:

> My previous code sample was incomplete, here's an accurate bro script to 
> go along with my trace if anyone wants to try it out.

Thanks! I'm now able to confirm it, and I will look into it. I'm
pretty sure that it's because ".*" does not match across new-lines.
However, I need to check whether we can change that or whether that
would break something else. 

Robin

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org