<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body text="#000000" bgcolor="#FFFFFF">We are considering
multi-flow and packet correlation for a number of our existing sensors
that we want to port to a combination of Suricata and/or Bro
environments. Some examples include matching ICMP echo and echo reply
messages and counting various types of ICMP messages coming from
individual IP addresses. We were thinking of using Suricata to identify
ICMP message types and then using Bro to do the counting per IP
address, or something like that. Our previous implementation used a
specialized architecture.<br>
<br>
Dan<br>
<br>
<blockquote style="border: 0px none;"
cite="mid:50B789ED.6000403@inliniac.net" type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="victor@inliniac.net" photoname="Victor Julien"
src="cid:part1.07030007.01000503@bbn.com" name="postbox-contact.jpg"
width="25px" height="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:victor@inliniac.net"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Victor Julien</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">November 29, 2012
11:14 AM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div><!----><br>We've been
talking to the Bro guys about this, but as far as I know,<br>nothing has
been done yet.<br><br>What kind of multi-flow correlation are you
looking for?<br><br></div></div>
</blockquote>
<br>
<div class="moz-signature">-- <br>________________<br>
<span style="font-weight: bold;">Dan Wyschogrod</span><br>
<br>
<span style="font-style: italic;">Senior Scientist</span><br>
<span style="font-style: italic;">Cyber Security</span><br
style="font-style: italic;">
<span style="font-style: italic;">Raytheon/BBN Technologies</span><br>
<br>
<a class="moz-txt-link-abbreviated" href="mailto:dwyschogrod@bbn.com">dwyschogrod@bbn.com</a><br>
<br>
</div>
</body></html>