[Bro] cannot read large pcap file

Jay Hwang hahaman5 at gmail.com
Mon Mar 6 07:17:54 PST 2006


Hi, I want to run bro with 300GB pcap file but it cannot run

jhwhang at wien:~/bro-0.9a11$ bro -r ~/jh/20051107_2200_2h_Rx.pcap.2
bro: problem with trace file /home/jhwhang/jh/20051107_2200_2h_Rx.pcap.2 -
/home/jhwhang/jh/20051107_2200_2h_Rx.pcap.2: File too large

I tried

./configure --prefix=/home/jhwhang/gb/bro/ --enable-largefile

and

CFLAGS=-D__USE_LARGEFILE64 ./configure --prefix=/home/jhwhang/gb/bro/
--enable-largefile

but both didn't work

How can I do?


--
황재호, Jay Hwang, KAIST, CS undergraduate
http://gon.kaist.ac.kr/~hahaman5/diary
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20060307/d3c98461/attachment.html 


More information about the Bro mailing list