[Bro] file identification modification

Seth Hall seth at icir.org
Fri Oct 21 06:42:36 PDT 2016


> On Oct 21, 2016, at 9:04 AM, erik clark <philosnef at gmail.com> wrote:
> 
> /\x21\x42\x44\x4E/
> 
> but the sig doesnt fire. However when I do
> 
> /!BDN/
> 
> it does. What gives? :)

I'm not sure offhand why that wouldn't work.

> Also, whats the number after the mimetype association mean? My mimetype is
> 
> application/outlook, 5

That's a priority.  Since multiple matches can happen, we've tried to make the signatures that should be more specific and reliable be higher priority.  The current numbers are a bit haphazard though.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/




More information about the Bro mailing list