[Bro] raw bytes question
Robin Sommer
robin at icir.org
Thu Apr 16 09:52:02 PDT 2009
On Thu, Apr 16, 2009 at 11:13 -0500, Tim Rupp wrote:
> Is there an event I can hook that would allow me to do a regex on the
> raw bytes of a packet if I knew the hex pattern of the bytes I want to
> match?
Per the mail I sent you earlier, that looks like a task for a
signature.
Robin
--
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro
mailing list