[Bro] Several protosig questions

[James Lay]

On Wed, 2016-10-19 at 17:28 -0700, Robin Sommer wrote:
> On Mon, Oct 17, 2016 at 15:08 -0600, you wrote:
> 
> > 
> > Included!  Sigs below (in 2.4.1 order mattered..I think last
> > matched
> > gets the protosig tag, but I've swapped these around with the same
> > results)..in either case only ntp matches, not ntp_apple.
> So both the problems turn out to be bugs: dst-ip is indeed not
> working
> with IPv4 CIDR ranges, and payload-size is behaving oddly with (I
> believe only) UDP. I have patches for both in git branch
> topic/robin/sig-fixes, could you give that a try?
> 
> Robin
> 
Can do....those patches in the bro git repository or somewhere else?  I
wasn't able to find them on github.  Thanks for the work Robin!
James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161019/740c73a9/attachment.html