[Bro] scheduled tasks on existing pcaps

Robin Sommer robin at icir.org
Wed Jun 18 10:57:38 PDT 2014

On Wed, Jun 18, 2014 at 12:13 -0500, Mike Dopheide wrote:

> Do Bro's scheduled tasks run in real time or network time when a pcap is
> passed to it?  I'm assuming real time,

No, it's network time actually, which drives pretty much everything in
Bro so that output doesn't differ when running live vs from a trace.


Robin Sommer * Phone +1 (510) 722-6541 *     robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 * www.icir.org/robin

More information about the Bro mailing list