[Bro] getting raw bytes?

[Seth Hall]

On Aug 10, 2011, at 12:00 PM, Dan Klinedinst wrote:

> But I think this will match from the beginning of the packet, if it
> works at all. I'll test it.


Signatures are implicitly anchored at the beginning of the stream. :)

I could have anchored it myself like you were thinking, but I just chose not to since it's implicit anyway.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/