[Bro] Create different file size from original one in HTTP File-extract

Seth Hall seth at icir.org
Mon Jul 22 20:07:44 PDT 2013

On Jul 22, 2013, at 5:24 PM, JH YANG <joonysky at yahoo.com> wrote:

> Pcap hasn't any missed parts but the file from Bro created uncompleted file which doesn't have last parts of file(2277bytes)

I think that there is a bug in Bro that shows up like this in some cases.  This is unlikely a bug that any of us on the core team are likely to look into though because there is new "file" handling code that is coming soon and just generally works better all around.

Sorry for the probably unsatisfactory answer, but things will be even better soon! :)


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list