[Bro] HTTP not being seen

James Lay jlay at slave-tothe-box.net
Mon Sep 16 08:22:31 PDT 2013


On 2013-09-16 09:20, Seth Hall wrote:
> On Sep 16, 2013, at 8:26 AM, James Lay <jlay at slave-tothe-box.net> 
> wrote:
>
>> I completely agree.  In my case however, I believe it's a "feature" 
>> of PPPoE…those same packets captured on the physical eth1 NIC are 
>> flawless with zero issues.  I tried having Bro listen to eth1, but I 
>> don't think it plays with the PPPoE.  Thanks for the input Seth.
>
>
> Hm, I think I have a patch around somewhere that adds PPPoE support
> to Bro… yep, found it.
> 	topic/seth/pppoe
>
> I also went ahead and updated that branch to be only diffs against
> the current master branch.  Let me know if you need any help if you
> decide to give it a try.
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/

Oh sweet thanks Seth...I'll give that a go today and report my results.

James



More information about the Bro mailing list