Pp. 31–52 of the Proceedings

Next: Abstract

 
• Abstract
• Introduction
• Structure of the system
  • libpcap
  • Event engine
  • Policy script interpreter
• The Bro language
  • Data types and constants
  • Operators
  • Variables
  • Statements
• Implementation issues
• Attacks on the monitor
  • Overload attacks
  • Crash attacks
  • Subterfuge attacks
• Application-specific processing
  • Finger
  • FTP
  • Portmapper
  • Telnet
• Status, performance, and future directions
• Acknowledgements
• Example: tracking Finger traffic
• References
• About this document ...