[Bro] impossibly large packets
jones at tacc.utexas.edu
Tue Feb 12 08:24:09 PST 2013
Most network adapters have LRO on by default. This can translate to large packets on bro input. If you running bro on linux you see this behavior.
From: bro-bounces at bro-ids.org [mailto:bro-bounces at bro-ids.org] On Behalf Of Tim Ray
Sent: Monday, February 11, 2013 2:15 PM
To: bro at bro-ids.org
Subject: [Bro] impossibly large packets
Does Bro have any way to handle corrupt packets that appear to be impossibly large? When we get those in our setup, it hangs. Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro