[Bro] Interesting observation with ssh on non-ssh port

James Lay jlay at slave-tothe-box.net
Wed Apr 2 14:10:24 PDT 2014

On 2014-04-02 14:58, Seth Hall wrote:
> On Apr 2, 2014, at 4:11 PM, James Lay <jlay at slave-tothe-box.net> 
> wrote:
>> I absolutely did.  I was originally scp'ing a file, then started to 
>> test with ssh'ing to the host and exiting out.  Is there a way to 
>> debug this?  I think I even compiled it for debugging :)
> You’re sure that your box was seeing the traffic you think it was?
> Also, if this is on a real network you want to be careful with
> building with debugging enabled because it can cause a large
> performance hit which can then cause it’s own problems.
>   .Seth
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/

Bah...the port I was listening on was a spanned port 8-|  Actually 
looping in on itself...shut that off and now I see things just 
fine...sorry for the waste of bits on the list.  Thanks Seth.


More information about the Bro mailing list