[Bro] wrong size computation

Vern Paxson vern at icir.org
Wed Dec 7 23:50:05 PST 2005

> Here it is a sample... it is just an handshake but if you run
> $bro -r to-brolist_anonym.pcap brolite
> you will see in the conn.log file the BIG computation mistake...

Hmmm, this appears to be specific to brolite.bro.  If I run on the trace
with mt.bro, it flags the sizes as "? ?", which seems fine in this case.
We'll look into it further.


More information about the Bro mailing list