about packet's load

Vern Paxson vern at icir.org
Mon Dec 23 23:07:44 PST 2002

> I use "packet load" as : the data of IP packet , or the data of TCP/UDP 
> packet.

Ah - the term you're looking for is "payload".  You can get this using
the "packet_contents" event handler, or using the new signature engine
(for which Robin Sommer has contributed a new chapter for the Bro
manual, which will be included in the next development release).


More information about the Bro mailing list