[Bro] Re： How does Bro capture the traffic of ftp data connection ?

[熊永平]

----- 原始邮件 ----
发件人： Robin Sommer <robin at icir.org>
收件人： ?$B7'1JJ? <john8xyp at yahoo.com.cn>
抄送： Bro at bro-ids.org; bro at ICSI.Berkeley.EDU
已发送： 2007/3/16(周五), 上午3:09:57
主题： Re: [Bro] How does Bro capture the traffic of ftp data connection ?

Thank you for your answer

How does bro be aware of the close of ftp data connection if she can't capture the corresponding tcp session packet? via the interactive info appeared in the ftp control connection?
And ，To dynamically capture some certain traffic without including all packet,  it feels feasible to create a new thread/process to run another bro to capture and   analyze，but  is this process so long as to miss some packets in that certain session?

On Thu, Mar 15, 2007 at 12:01 +0800, you wrote:

>    So how does it dynamically add the filter string to capture the
> temporary traffic?

It doesn't. Dynamically changing the BPF filter is too expensive as
it would need to be recompiled every time (and the filter would
quickly get huge). 

If you want Bro to analyze the content of ftp-data sessions, you
need to manually override the pcap filter to include all packets,
e.g., by running with "-f tcp". 

Robin

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org







		
___________________________________________________________ 
雅虎免费邮箱-3.5G容量，20M附件 
http://cn.mail.yahoo.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20070316/e58d1f25/attachment.html