[
https://bro-tracker.atlassian.net/browse/BIT-76?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16816#comment-16816
]
Seth Hall commented on BIT-76:
------------------------------
First, to get one thing out of the way, scan.bro doesn't fire on this trace
(and I don't think it should).
But Vlad pointed out something interesting about this trace. It seems to cause
the get_file_handle event to get generated quite a few times. That really
doesn't make any sense to me. Something to look into at some point.
> Low port trolling vs. backscatter
> ---------------------------------
>
> Key: BIT-76
> URL: https://bro-tracker.atlassian.net/browse/BIT-76
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Reporter: Vern Paxson
> Priority: Low
> Labels: scan
> Attachments: backscatter.trace
>
>
> Running on the attached trace, mt.bro correctly diagnoses backscatter, but
> then goes on to later complain about low-port trolling. Seems this latter
> should be suppressed, as it's just a follow-on from the backscatter.
--
This message was sent by Atlassian JIRA
(v6.3-OD-06-017#6327)
_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
