[Bro] connection states

[Laleh Arshadi]

Hi Ron
 
Thanks for the link but unfortunately it does not contain all the information I am looking for.
 
L. Arshadi


________________________________

FYI
 
I found the below link.
 
 
Thanks
 
 
http://www.icir.org/robin/rwth/bro-tour.pdf 
 
 
 
Ron Jenkins (SnortCP, VCP (3/4), MCNE, CNE6, MCP,CCNA)
 
 

Dear all,
 
Seems that Bro classifies connections into a number of states in its "connection summaries" log files. States such SF, REJ, etc. upon which it then classifies the connection into one of the three states "good", "bad' or "unkown". I was wondering if one could give me a direct pointer to a reference in which these states are discussed thoroughly.
 
Regards
L. Arshadi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130721/f2088887/attachment.html