(no subject)

[Bro] Signature payload matching

Hi all,

I’m working for automation of signature generation for Bro from pcap trace
files.
I would like to know if the matching of the payload as a condition is done
against all the session data or more like per packet matching.

Thanks

Kristen Eisenberg
Billige Flüge
Marketing GmbH
Emanuelstr. 3,
10317 Berlin
Deutschland
Telefon: +49 (33)
5310967
Email:
utebachmeier at gmail.com
Site:
http://flug.airego.de

  • Billige Flüge vergleichen

For TCP it's all session data. Also see:

    http://www.bro-ids.org/documentation/signatures.html

Robin