[Bro] impossibly large packets

Seth Hall seth at icir.org
Mon Feb 11 12:44:41 PST 2013

On Feb 11, 2013, at 3:41 PM, Tim Ray <tray at 21ct.com> wrote:

> How does Bro handle such a case? Does it understand that such a thing is
> corrupt?

How was this packet acquired?  It sounds like you have a corrupted packet capture.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list