[Bro] Bro with 10Gb NIC's or higher
seth at icir.org
Fri Jan 9 13:45:03 PST 2015
> On Jan 9, 2015, at 4:37 PM, John Donnelly <jdonnelly at dyn.com> wrote:
> How I can I specify another directory ?
What do you mean?
> What do the fields mean ?
> root at x64-01:/# cat cap*
That last number is the estimated percent of packet loss. Unnnnnfortunately, I think I know enough to guess that your traffic is heavily leaning toward DNS and capture-loss relies on having a lot of TCP available so in your case the numbers might be misleading.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro