how to use Bro getting 41 features of a connect record
  The author said Bro is modified to generate the 41 features, I
would preciated if someone is kind enough to give me some hints how
to do this. I am sure a event analyser and handler sould added to
Bro, but where, how and when to invoke the event handler.

Presumably, yes, they wrote policy scripts, and perhaps also extended
the event engine. But it seems you should ask the authors directly
to get the details.



I can see that Bro supports HTTP methods - GET, HEAD and POST.
But in between i see entries in weird.log saying -
1041827706.208639 > *.*.*.*/http: HTTP_unknown_method

I am using bro 0.7a90 and was wondering if analysis of other methods are being done
with latest version ...?