[Bro] pcap_next Question

Robin Sommer robin at icir.org
Mon May 21 10:19:44 PDT 2012

On Mon, May 21, 2012 at 16:48 +0000, Siwek, Jonathan Luke wrote:

> about errors so some text can be relayed to the user, maybe that
> function didn't exist at the time the code was written.

Yes, I think that's the reason, we were trying to stay compatible to
older pcaps for a while. It should be safe to switch to pcap_next_ex()
now, but I'd like to understand the underlying problem here. I don't
think we have seen this problem reported from elsewhere yet. Could
this be an artifact of the VM setting?


Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list