# flow-level analysis code **URL:** \ **Category:** Zeek\ **Created:** [December 19, 2004, 2:06am UTC](https://community.zeek.org/t/flow-level-analysis-code/660 "2004-12-19T02:06:45Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [December 19, 2004, 2:06am UTC](https://community.zeek.org/t/flow-level-analysis-code/660/1 "2004-12-19T02:06:45Z")
> If I'm not wrong Bro just see the 'local' network More precisely, just see what transits whatever link(s) for which it has taps. Also, the ability of Bro's to exchange events allows a broader set of perspectives to be integrated, though we haven't put this together operationally yet (we will soon). In addition, the Bro client library (Broccoli) allows integration of host events into the network analysis. One interesting example here is an sshd instrumented to tell Bro about authentication attempts/successes, as well as possibly sending it the clear text of a login session (yes, a scary thought!; this happens over SSL, not in the clear, but still gives some people the heeby-jeebies). We have a prototype of that pretty much done.     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/flow-level-analysis-code/660/2 "2022-05-06T15:37:18Z")
Closed on May 6, 2022, 3:37pm UTC