[Bro] Bro and NetBIOS

[Seth Hall]

On Oct 20, 2014, at 6:50 AM, Vito Logrillo <vitologrillo at gmail.com> wrote:

> i'm trying to use BRO to analyze data based on NetBIOS protocol: i'm using BRO 2.3.1.

SMB support in 2.3.1 (and earlier) is broken and wildly incomplete.

> Another question: SMB2.0 protocol is supported by BRO or not?

It should be moderately supported in 2.4.  Broala has contributed an SMB (1+2) analyzer and it should be in 2.4.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/