[Bro] handle out of order and retransmitted packets in offline trace

Vern Paxson vern at icir.org
Tue May 31 09:17:08 PDT 2011

> Actually, it stores
> port 80 as 20480 and it stores other port numbers differently from they are
> supposed to be. Anyone knows the reason? Is it a kind of one to one mapping?

As I already told you via private email, you are looking at the little-endian
version of 80 rather than the big-endian.


More information about the Bro mailing list