June 2016
Beginner to intermediate
322 pages
6h 18m
English
Content preview from Practical Windows ForensicsBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
Knowing Bro
Another tool to analyze network traffic is Bro. Bro is a very powerful tool, which is often positioned as an IDS, but the possibilities are much wider with Bro. Discussing all of them in a single chapter is almost impossible, so we will consider only some of them. One of the many advantages of Bro is the ability to use ready-made parsers different protocols.
For example, the following are some of them:
- DHCP
- DNS
- FTP
- HTTP
- POP3
- SMTP
- SSH
The list of these protocols is constantly expanding.
By default, Bro applies the protocol analyzers to traffic, and it records the results in the log files that correspond to different protocols.
Bro also allows you to write your own handlers in a language called Bro. For each event that occurs during the processing ...