[Bro] SMB/NetBIOS

[Martin Holste]

Yep, the egress of a datacenter where fileservers sit is a great place
to put an NSM sensor, and all clients have to pass through those
gates, so all desktop-fileserver access can be audited.

On Mon, Apr 23, 2012 at 3:43 PM, relevant username
<relevantusername at gmail.com> wrote:
> I can't answer for Martin, but we do, heavily.
>
>
> On Mon, Apr 23, 2012 at 3:41 PM, Seth Hall <seth at icir.org> wrote:
>>
>>
>> On Apr 23, 2012, at 4:25 PM, Martin Holste wrote:
>>
>> > A big +1 for this analyzer.  Turning on this functionality on the
>> > server-side impacts performance significantly, so being able to do
>> > this on the network is a big win.
>>
>>
>> Do you currently monitor in locations where you see SMB traffic?
>>
>>  .Seth
>>
>> --
>> Seth Hall
>> International Computer Science Institute
>> (Bro) because everyone has a network
>> http://www.bro-ids.org/
>>
>