[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bro
Subject:    Re: [Bro] (no subject)
From:       Seth Hall <seth () icir ! org>
Date:       2011-11-02 15:57:41
Message-ID: 30CB2422-EAC2-4D82-A1E1-9ECE79FA58AF () icir ! org
[Download RAW message or body]


On Nov 2, 2011, at 11:47 AM, Rodrigue ALAHASSA wrote:

> I just read an article \
> (http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.70.824&rep=rep1&type=pdf) \
> which compares performances of Bro and Snort. The authors stated at section 5.6 \
> that Bro does not have a Unicode decoder for HTTP URI. Since their work were based \
> on Bro 0.9a9, I guess this is not applicable for the current versions of Bro.  
> Can someone confirm or infirm my point of view ? 

Bro does not consider unicode in any way right now.  Strings are only considered to \
be strings of individual bytes but low order ascii characters will be printed as \
such.  Does that answer your question?  I've been thinking about how to appropriately \
add unicode support for quite a while but I don't have a completely clear notion yet.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/


[prev in list] [next in list] [prev in thread] [next in thread]