[Bro] (no subject)

Seth Hall seth at icir.org
Wed Nov 2 08:57:41 PDT 2011


On Nov 2, 2011, at 11:47 AM, Rodrigue ALAHASSA wrote:

> I just read an article (http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.70.824&rep=rep1&type=pdf) which compares performances of Bro and Snort. The authors stated at section 5.6 that Bro does not have a Unicode decoder for HTTP URI. Since their work were based on Bro 0.9a9, I guess this is not applicable for the current versions of Bro. 
> 
> Can someone confirm or infirm my point of view ? 

Bro does not consider unicode in any way right now.  Strings are only considered to be strings of individual bytes but low order ascii characters will be printed as such.  Does that answer your question?  I've been thinking about how to appropriately add unicode support for quite a while but I don't have a completely clear notion yet.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/





More information about the Bro mailing list