[Bro] Application Layer Classification

[Christian Kreibich]

Hi Christian,

On Mon, 2007-01-15 at 15:59 +0100, Christian Novello wrote:
> Is there any way to let Bro recognize any HTTP session (for example)
> even if it does not have port 80 or 8080 or such? And... is it
> possible to generalize this behavior on any protocol?

yes, see http://www.bro-ids.org/wiki/index.php/DynamicProtocolDetection
for the details.

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org