[Oisf-users] UDP reassambly behaviour
seth at icir.org
Wed Jun 20 16:16:26 UTC 2012
On Jun 20, 2012, at 12:10 PM, Victor Julien wrote:
> So does Bro do any effort to figure out the correct order of the UDP
> datagrams before doing the "reassembly"? I guess with higher level
> protocol knowledge you could do it.
Nope. You're right though, that's left to the particular analyzer that might be handling the connection. Our analyzer API has stream and packet interfaces so depending on the needs of any particular protocol you can get the traffic as a stream or per-packet.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Oisf-users