[Bro] Bro 2.5 Beta available
Azoff, Justin S
jazoff at illinois.edu
Sat Aug 20 19:08:03 PDT 2016
> On Aug 20, 2016, at 5:38 PM, rmkml <rmkml at ligfy.org> wrote:
> Thx all for awesome Bro project!
> Could you check if BIT-1562 (lock on old pcap file) fix is present on 2.5 beta version please ?
> (because first test repeat lock)
> Best Regards
Yes.. this was fixed back in May. What do you mean by "first test repeat lock" ? Which pcap did you test on which bro version?
[jazoff at bro-test tmp]$ bro --version
bro version 2.5-beta
[jazoff at bro-test tmp]$ time bro -r bro241lock.pcap
1243601416.209199 warning in /usr/local/bro/share/bro/base/misc/find-checksum-offloading.bro, line 54: Your trace file likely has invalid IP checksums, most likely from NIC checksum offloading. By default, packets with invalid checksums are discarded by Bro unless using the -C command-line option or toggling the 'ignore_checksums' variable. Alternatively, disable checksum offloading by the network adapter to ensure Bro analyzes the actual checksums that are transmitted.
[jazoff at bro-test tmp]$ time bro -C -r bro241lock.pcap
- Justin Azoff
More information about the Bro