[Bro] wrong size computation
falletta at ftw.at
Sat Dec 10 10:55:29 PST 2005
But if I turn on signature detection i.e. if I run
$bro -r to-brolist_anonym.pcap mt brolite-sigs
then I get AGAIN the same error... so what's up?
Vern Paxson wrote:
>>Here it is a sample... it is just an handshake but if you run
>>$bro -r to-brolist_anonym.pcap brolite
>>you will see in the conn.log file the BIG computation mistake...
> Hmmm, this appears to be specific to brolite.bro. If I run on the trace
> with mt.bro, it flags the sizes as "? ?", which seems fine in this case.
> We'll look into it further.
More information about the Bro