Bro-IDS analysis scripts
========================
Many or all of these scripts will currently require Robin Sommer's branch
of Bro.  

  http://blog.icir.org/2007/12/robins-development-branch.html


ssh-ext.bro
-----------
Determination of a successful SSH connection is made by the byte count
returned by the server.  The default is 5500 bytes.  Redef the 
authentication_data_size variable to change it (for example to 4k)...
    redef SSH::authentication_data_size = 4000;