Hi Seth, Yes, I have a pcap containing the ALTER_CONTEXT req/resp packets. I will start working on the bug fix and submit to BIT, with pcap and test script, hopefully soon.
Cheers, Mark -----Original Message----- From: Seth Hall [mailto:[email protected]] Sent: Saturday, February 3, 2018 10:46 PM To: Fernandez, Mark I <[email protected]> Cc: [email protected] Subject: Re: [Bro-Dev] Bro DCE-RPC Fix for AlterContext and AlterContextResponse Parsers On 2 Feb 2018, at 9:54, Fernandez, Mark I wrote: > 5. Bro Issue Tracker > > I plan to submit this to Bro Issue Tracker. Just wanted to give you a > heads up here. Thanks Mark! Those were probably my comments. Unfortunately there were a number of areas where I just ran out of steam doing investigations into why things were happening the way they were so this investigation is deeply appreciated. Do you have PCAPs with ALTER_CONTEXT messages in them? Because this is difficult-to-understand change without seeing actual traffic it would be best if you were able to submit the changes along with tests. Thanks, .Seth -- Seth Hall * Corelight, Inc * www.corelight.com _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
