[Bro] - http$host diff between bro and broctl
william de ping
bill.de.ping at gmail.com
Thu Jun 22 06:46:14 PDT 2017
Thank you ! it turns out to be checksum
On Thu, Jun 22, 2017 at 12:17 AM, Azoff, Justin S <jazoff at illinois.edu>
> > On Jun 21, 2017, at 12:29 PM, william de ping <bill.de.ping at gmail.com>
> > Hi all,
> > Scenario 1 : bro instance on my local interface + browsing to
> > Scenario 2 : bro cluster with a single Worker on my local interface +
> browsing to www.cnn.com
> > in http.log,
> > on the 1st scenario, the host field is initialized with www.bbc.com
> > on the 2nd scenario, the host field is NOT initialized
> > I'm running bro 2.5
> > Is there any explanation for the diff ?
> You're probably starting bro differently in the two cases.
> - Justin Azoff
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro