[Bro] Extracting Email Attachments

Seth Hall seth at icir.org
Fri Mar 22 12:59:25 PDT 2013


On Mar 22, 2013, at 3:34 PM, Digital Ninja <dn1nj4 at gmail.com> wrote:

> redef SMTP::extract_file = T;
> redef SMTP::calc_md5 = T;

These two lines don't make any sense.  Those names aren't globals, they are fields of the SMTP::EntityInfo record type.  You can set them in certain situations but you shouldn't need to since the other lines you had should take care of what you're trying to do (once you have that little error that Bernhard pointed out fixed).

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/





More information about the Bro mailing list