[Bro] Extract files not authentic copy of file

Vern Paxson vern at corelight.com
Thu Feb 22 17:14:20 PST 2018

> Are you having any trouble with dropped packets?  If you are dropping a 
> lot of packets, it's possible for your extracted files to be 
> problematic.

Along with that, another possibility is that the host does some transformation
before storing the file.  What types of files are these?


More information about the Bro mailing list