zeek/scripts/base
Seth Hall e4b620673b More DCE_RPC improvements.
- The logic for fragment handling has been rewritten and should be correct now.
 - There are now tunables for fragment handling overflow situations.
   - DCE_RPC::max_cmd_reassembly and DCE_RPC::max_frag_data
   - They result in weirds and analyzer removal.
 - Memory leak fixed by unique_ptr auto cleanup.
 - DCE_RPC is now intolerate of content gaps and will stop
   analyzing traffic if content gaps happen (like most other analyzers currently).
2016-10-24 03:22:20 -04:00
..
files Added missing README files for documentation 2016-10-10 22:55:50 -05:00
frameworks Handle removing non-existent intel items. 2016-09-21 00:37:38 +02:00
misc Merge remote-tracking branch 'origin/topic/johanna/version' 2016-10-02 17:48:28 -07:00
protocols More DCE_RPC improvements. 2016-10-24 03:22:20 -04:00
utils Merge remote-tracking branch 'origin/topic/johanna/rawleak' 2016-06-18 09:49:17 -07:00
init-bare.bro Add descriptions for what the SMB1 events do, and references to the specification. 2016-10-03 17:22:05 -05:00
init-default.bro Add convenient way to access version information to Bro. 2016-09-29 12:45:48 -07:00