[Bro] HTTP Question

[Diogo Corteletti de Oliveira]

Yeah! You are right there's also "detect-protocols-http.bro"


Jean-Philippe Luiggi escreveu:
> Diogo Corteletti de Oliveira a écrit :
>> Hello,
>>
>>             Can BRO alarm on non-http traffic over port 80?
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>>
>>
>>
>>
>>
>> !DSPAM:1,47349958153933285824817!
>>   
> Hello Diogo,
> I think so if you use DPD (dynamic protocol detection).
> Please note there's already a file "detect-protocols.bro" which
> is able to find connections with protocols on non-standard ports.
>
> Best regards,
>
> Jean-philippe
>
>
>