[Bro] how to merge rx and tx from different pcaps / slightly off-topic
jbarber at computer.org
Thu Sep 10 04:34:43 PDT 2015
Seth, Thanks for the clarification.
Uggh... It appears that shady stuff my plugin is doing is responsible for
I think the problem is that I have opened a live pkt src from within my
plugin, but then also trying to read a pcap. Maybe I've seeded BRO with a
later timestamp than those in the pcap? Having a hard time following the
Is it possible to instantiate a per-PktSrc timer?
Anyway, sorry to be spewing misinformation.
On Wed, Sep 9, 2015 at 9:55 PM, Seth Hall <seth at icir.org> wrote:
> > On Sep 9, 2015, at 5:09 PM, Jeff Barber <jbarber at computer.org> wrote:
> > If you don't specify --pseudo-realtime, BRO will apparently run
> connection timers based on the current wall clock time, comparing the wall
> clock with the start time recorded in conjunction with the packets in the
> pcap. This means it may see a connection start, then immediately expire it
> as having passed the session time limit. [What? That session is six months
> That’s actually not how Bro works, it uses the timestamps in the packets
> to drive it’s packet clock forward. Could you show how you’re running
> Bro? It sounds to me like you’re replaying traffic to and interface and
> then sniffing it.
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro