> On Feb 12, 2015, at 6:06 PM, Jonathan Siwek <[email protected]> wrote: > > -event socks_login_reply%(c: connection, code: count%); > +event socks_login_userpass_reply%(c: connection, code: count%);
Did you find evidence that SOCKS uses a different reply message for different login types? When I was reading I thought that the same login reply message structure was used in response to any login type. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro.org/ _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
