Hi
My understanding is that Bro has some northbound API to openflow switches or controllers. I am wondering whether any development branch has analyzer of openflow controllers. Just try to see whether I can use Bro to analyze some controller-to-switch traffics.
Best,
Hui
Have you looked at the netcontrol framework in Bro, developed by Johanna?
Actually, netcontrol is what I thought of as northbound APIs. I actually just wonder whether Bro has analyzer for openflow protocol or not (some refer them as southbound traffics). It not, I probably need to use wireshark to output the pcap and analyze them manually.
I get you now. I am not aware of an open flow protocol analyzer in Bro.
Just to add to this - there is no analyzer and so far this is also not planned. In addition to that - OpenFlow encourages use of TLS, so you (hopefully) should not actually see a lot of unencrypted OF traffic on the wire.
Johanna