[Bro] raw bytes question

Robin Sommer robin at icir.org
Thu Apr 16 09:52:02 PDT 2009


On Thu, Apr 16, 2009 at 11:13 -0500, Tim Rupp wrote:

> Is there an event I can hook that would allow me to do a regex on the
> raw bytes of a packet if I knew the hex pattern of the bytes I want to
> match?

Per the mail I sent you earlier, that looks like a task for a
signature.

Robin

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the Bro mailing list