[Bro] wrong size computation

Vincenzo Falletta falletta at ftw.at
Sat Dec 10 10:55:29 PST 2005

But if I turn on signature detection i.e. if I run

$bro -r to-brolist_anonym.pcap mt brolite-sigs

then I get AGAIN the same error... so what's up?


Vern Paxson wrote:
>>Here it is a sample... it is just an handshake but if you run
>>$bro -r to-brolist_anonym.pcap brolite
>>you will see in the conn.log file the BIG computation mistake...
> Hmmm, this appears to be specific to brolite.bro.  If I run on the trace
> with mt.bro, it flags the sizes as "? ?", which seems fine in this case.
> We'll look into it further.
> 		Vern

More information about the Bro mailing list