[Bro] bro help please

Seth Hall hall.692 at osu.edu
Wed Apr 7 05:12:29 PDT 2010

On Apr 7, 2010, at 2:11 AM, vijay khadse wrote:

>                bro: problem with trace file /usr/local/bro/090500-0- 
> anon.pcap - unknown data link type 0x68

The packets in tracefile are encapsulated in something strange at  
layer-2.  Most commonly, the packets would be encapsulated in Ethernet  
headers (aka EN10MB).  I don't know what 0x68 is.


Seth Hall
Network Security - Office of the CIO
The Ohio State University
Phone: 614-292-9721

More information about the Bro mailing list