Is there an existing bro script that sessionizes the incoming packet flow but keeps all of the original packets associated with each recognized session?
This seems like something fairly "standard", so I probably don't need to reinvent the wheel on this one.
Thank you,
Greg
Is there an existing bro script that sessionizes the incoming packet
flow but keeps all of the original packets associated with each
recognized session?
I'm not following - what do you mean by "sessionizes"?
Vern
Basically I mean collects and orders the packets from the same flow (such as an http session, but not limited to any particular protocol).
Thank you.
Greg