Actions
Feature #5674
openSupport layered protocols
Description
Like DCERPC can be directly over UDP, or over SMB
Actions
Added by Philippe Antoine about 3 years ago. Updated almost 2 years ago.
Description
Like DCERPC can be directly over UDP, or over SMB
Idea to do this : create a synthetic sub flow, so that each flow has its own app-layer
Philippe Antoine wrote in #note-4:
Idea to do this : create a synthetic sub flow, so that each flow has its own app-layer
People may get confused if two flows get logged (one synthetic and a real one) with different app-layers