[Bro] loading modules and automatically using custom scripts (clautos)

Seth Hall seth at icir.org
Thu Sep 8 07:05:11 PDT 2016


> On Sep 8, 2016, at 5:49 AM, clautos <sebclaut at gmail.com> wrote:
> 
> When I download audacity (.exe) through HTTP, I get an inccorect .exe file. The original file has a size of 26.5 MB and what I collect in my "extract_files" folder has a size of 1.4 kB. Obviously the md5sums mismatch.

It's very possible that you encountered packet loss.  You can either look at the "missed_bytes" field in conn.log or the "missing_bytes" field in the files.log.  If either of those aren't zero, then you probably dropped packets.

Damn, now that I look at those field names, we ended up naming them unfortunately different.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/




More information about the Bro mailing list