[Bro] Bro Alarms

Vern Paxson vern at icir.org
Mon Nov 12 12:36:27 PST 2007


>              I've noticed that the alarms are been triggered with a 
> normal conection to gmail. Do you need the entire trace ? From the 
> Handshake to the FIN?

In general, yes, otherwise Bro isn't going to process it when run
off-line.

		Vern



More information about the Bro mailing list