Hi all,
I add a script to Bro2.x, which make it could support pop3 now.
The pop3_login_success event could work ok, it output the logs I need. But the event pop3_login_failure failed.
I use a wrong user and password to login pop3 server, I can find the login failure through the wireshark, BUT the Bro could not generate the corresponding logs. I do not know that whether or not the Bro pop3_login_failure could not discover the real pop3 login failure?