[Bro] A little more confusion with Intel

James Lay jlay at slave-tothe-box.net
Fri Feb 2 14:08:35 PST 2018


Thanks Gents,

Looks like the intel-seen-more may fix the problem..I'll test and report 
my findings.

James

On 2018-02-02 11:57, Vern Paxson wrote:
>> I think EFFECTIVE_DOMAIN is better and
>> it matches the function being called in the domain-tld package.
> 
> FWIW, sometimes the term "registered domain" is used for this.
> 
> 		Vern
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro


More information about the Bro mailing list