[Bro] - MTU and defragmentation

william de ping bill.de.ping at gmail.com
Wed Dec 6 08:23:19 PST 2017


Hello,

I wonder what happens if my mtu is set to 1500 (default) and a jumbo TCP or
UDP packet is sent to Bro's monitored interface.

Will Bro parse only the packet containing the IP header ?
>From my tests I see that Bro does not defragment the packets by default,
any flag I should use for that ?

Thanks
B
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20171206/e57bfb61/attachment.html 


More information about the Bro mailing list