[Bro] modifying bro.init
vern at icir.org
Wed Feb 3 22:14:11 PST 2010
> > Thanks for your help before. I found that the DNS parser was giving me
> > trouble due to many of the IP checksum errors. I don't really care
> > much about these errors anyways.
> Ah, that trips up everyone eventually I think. :)
These comments confuse me. If a packet has an IP checksum error, then the
DNS parser shouldn't even analyze the packet. However, turning on
ignore_checksum=T will cause it to analyze the bad packet, so if anything
it should give trouble rather than reduce trouble.
More information about the Bro