[Bro] Can Bro detect a traffic difference, according to days and time.

[Manmeet Gill]

Hi everybody,

I will give a scenario let me know is it possible using Bro ids or not.

If there is a traffic of tcp,udp,icmp,https,smtp and dns,
80%,50%,30%,70%,80% and 60% respectively during working days(mon-fri)(from
10am-6pm) which we can say is a normal traffic. and if these traffic
differs with 10% below or above for each protocol.  then alarm should be
triggered, similarly with (off hours 7pm to 9am) if we see same amount of
traffic,  alarm should be triggered. Is it possible with Bro to make this
type of scenario detectable.

--manmeet singh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160301/f9b8c95a/attachment.html