[Bro] signarture dst-port issue

[Robin Sommer]

On Mon, Aug 04, 2008 at 10:33 +0200, Miguel Angel Calvo Moya wrote:

> I am having trouble using signatures on bro. Lets say we have the following signature

Can you send me a small trace with which you see the problem and the
exect command line you're using to start Bro? 

> Also, does anybody know whether next release will implement other
> regular expression matching library?

No, we don't have any plans to switch to another regexp library.

>  I am trying to update snort2bro to support the snort pcre, however
>  it is not a trivial task.

Cool! but yeah, not exactly trivial. :)

Robin

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org