[Bro] Bro 2.5 Beta available
rmkml at ligfy.org
Mon Aug 22 12:19:39 PDT 2016
I am wrong, it's my bad, sorry for noise.
Happy Bro Testing
On Sun, 21 Aug 2016, Azoff, Justin S wrote:
>> On Aug 20, 2016, at 5:38 PM, rmkml <rmkml at ligfy.org> wrote:
>> Thx all for awesome Bro project!
>> Could you check if BIT-1562 (lock on old pcap file) fix is present on 2.5 beta version please ?
>> (because first test repeat lock)
>> Best Regards
> Yes.. this was fixed back in May. What do you mean by "first test repeat lock" ? Which pcap did you test on which bro version?
> [jazoff at bro-test tmp]$ bro --version
> bro version 2.5-beta
> [jazoff at bro-test tmp]$ time bro -r bro241lock.pcap
> 1243601416.209199 warning in /usr/local/bro/share/bro/base/misc/find-checksum-offloading.bro, line 54: Your trace file likely has invalid IP checksums, most likely from NIC checksum offloading. By default, packets with invalid checksums are discarded by Bro unless using the -C command-line option or toggling the 'ignore_checksums' variable. Alternatively, disable checksum offloading by the network adapter to ensure Bro analyzes the actual checksums that are transmitted.
> real 0m1.157s
> user 0m1.079s
> sys 0m0.050s
> [jazoff at bro-test tmp]$ time bro -C -r bro241lock.pcap
> real 0m0.936s
> user 0m0.863s
> sys 0m0.048s
> - Justin Azoff
More information about the Bro