[Bro] Reassembling packets during inspection

Vern Paxson vern at icir.org
Thu Aug 12 23:26:59 PDT 2010


> I realize that UDP doesn't have  
> sequence numbers, etc, but I was hoping that Bro would be able to  
> assemble the flow into something that could be externally processed.  

Yeah, I see your point, but no, it doesn't have that in it.  It wouldn't
be hard to add in simplistic terms (i.e., append the payload of every new
datagram in a flow to the end of the content file).  Doing it in a semantic-
aware fashion would of course be considerably trickier.

		Vern



More information about the Bro mailing list