[Bro-Dev] Logging TCP server banners

2018-02-12 Thread Pierre LALET
Hi everyone, [This mail has been sent to bro@ first, but I think I might have more luck (and answers) here. Sorry for the inconvenience to those who have already read it.] For a network recon framework I am working on (https://ivre.rocks/ -- for those interested), I would like to log each "TCP se

Re: [Bro-Dev] Logging TCP server banners

2018-02-13 Thread Pierre LALET
Hi, On Mon, Feb 12, 2018 at 05:18:05PM -0500, Seth Hall wrote: > This fits with a feature that I've been talking to several people > about for quite a while which would make a bit of the beginning of > each direction of a connection available in script-land. I think that would be great! > That w

Re: [Bro-Dev] Logging TCP server banners

2018-02-13 Thread Pierre LALET
Hi, On Tue, Feb 13, 2018 at 09:15:21AM +0100, Bencteux Jeffrey wrote: > A solution could be to blacklist such connections, i-e if there is data > sent by the client, then do not log: > > if (! is_orig && seq == 1 && c$orig$num_pkts == 2 && c$orig$size == > > 0) > > Another thing that com