[Bro] File Extraction wierdness

Seth Hall seth at icir.org
Tue Feb 9 20:09:13 PST 2016

> On Feb 9, 2016, at 9:33 PM, Blake Mackey <Blake.Mackey at rmc.ca> wrote:
> Is this normal behaviour? Or is Bro relatively bulletproof when it comes to file extraction?

Yes, it's generally functional.

> Could anyone suggest alternative things I can try to resolve this?

Could you capture some traffic that is giving you trouble and send it to me (offlist)?  It sounds to me like you're having packet loss issues, but I can't be sure without seeing the raw traffic.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list