[Bro] bro help please

Vern Paxson vern at icir.org
Wed Apr 7 08:01:48 PDT 2010

> adding support for other encapsulation types seem to just be a matter of
> telling bro what the offset to the data is at the end of src/PktSrc.cc

Yeah, that should generally suffice provided it's a fixed-length header.
Conceptually Bro would also need to be told per packet's encapsulated
within it (e.g., IPv4 vs. ARP), but it actually has a hack to figure this
out itself.


More information about the Bro mailing list