[Bro] Reassembling packets during inspection
Vern Paxson
vern at icir.org
Thu Aug 12 23:26:59 PDT 2010
> I realize that UDP doesn't have
> sequence numbers, etc, but I was hoping that Bro would be able to
> assemble the flow into something that could be externally processed.
Yeah, I see your point, but no, it doesn't have that in it. It wouldn't
be hard to add in simplistic terms (i.e., append the payload of every new
datagram in a flow to the end of the content file). Doing it in a semantic-
aware fashion would of course be considerably trickier.
Vern
More information about the Bro
mailing list