<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE></TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=2>Hello Bro developers and users,<BR>
<BR>
I'm new to Bro but I'm thinking about using it in my thesis research. So far the installation of 1.3.2 and 1.2.1 has gone well.<BR>
<BR>
As a test I ran bro against trace1.tcpdump and buffer-overflow-attack.tcpdump which worked fine. Next I created a tcpdump file using tcpdump -w test.out. Tcpdump captured several packets. When bro is ran against this file it kicks out an error:<BR>
<BR>
command given: bro -r test.out tcp<BR>
<BR>
error returned:<BR>
<BR>
line 1: warning: event handlers never invoked:<BR>
line 1: warning: account_tried<BR>
<BR>
Is there a trick to creating the tcpdump files?<BR>
<BR>
Running FreeBSD 6.2 with libpcap 0.97<BR>
Used root for all commands.<BR>
$PATH is updated with /usr/local/bro/bin<BR>
<BR>
setenv BROPATH /usr/local/bro/policy:/usr/local/bro/site<BR>
setenv BRO_DNS_FAKE 1<BR>
<BR>
Any explanation you can share about this error would be great.<BR>
Thanks.<BR>
<BR>
v/r<BR>
Thomas Tenhunen<BR>
Naval Postgraduate School<BR>
Code 368-SFS<BR>
ttenhune@nps.edu<BR>
</FONT>
</P>
</BODY>
</HTML>