发件人： Robin Sommer robin@icir.org
收件人： ?$B7’1JJ? john8xyp@yahoo.com.cn
抄送： Bro@bro-ids.org; bro@ICSI.Berkeley.EDU
已发送： 2007/3/16(周五), 上午3:09:57
主题： Re: [Bro] How does Bro capture the traffic of ftp data connection ?
Thank you for your answer
How does bro be aware of the close of ftp data connection if she can’t capture the corresponding tcp session packet? via the interactive info appeared in the ftp control connection?
And ，To dynamically capture some certain traffic without including all packet, it feels feasible to create a new thread/process to run another bro to capture and analyze，but is this process so long as to miss some packets in that certain session?
So how does it dynamically add the filter string to capture the
temporary traffic?
It doesn’t. Dynamically changing the BPF filter is too expensive as
it would need to be recompiled every time (and the filter would
quickly get huge).
If you want Bro to analyze the content of ftp-data sessions, you
need to manually override the pcap filter to include all packets,
e.g., by running with “-f tcp”.
Robin