[Bro] modifying bro.init

Vern Paxson vern at icir.org
Wed Feb 3 22:14:11 PST 2010


> > Thanks for your help before. I found that the DNS parser was giving me
> > trouble due to many of the IP checksum errors. I don't really care
> > much about these errors anyways.
> 
> Ah, that trips up everyone eventually I think. :)

These comments confuse me.  If a packet has an IP checksum error, then the
DNS parser shouldn't even analyze the packet.  However, turning on
ignore_checksum=T will cause it to analyze the bad packet, so if anything
it should give trouble rather than reduce trouble.

		Vern



More information about the Bro mailing list