Hi,<br><br>could you possibly point me towards which files or functions I should look at to get rid of these sanity checks? I know I'm not exactly using Bro for its proper use - I just need it to provide a ground truth for all flows inside of a trace. So far I've had no problems with full tcpdump traces, but if I could just find a way for it to handle partial tcpdump traces then it would suit my needs perfectly.<br>
Thanks.<br><br>Daniel.<br><br><div class="gmail_quote">On Tue, Apr 22, 2008 at 6:02 PM, Robin Sommer <<a href="mailto:robin@icir.org">robin@icir.org</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d"><br>
On Tue, Apr 22, 2008 at 08:36 -0700, I wrote:<br>
<br>
> I think yes, it should. My guess would have also been that it's the<br>
> checksum check which prevents Bro from doing the matching. I'll try<br>
> it later to see what I can find.<br>
<br>
</div>So I looked briefly into this: there are more sanity checks inside<br>
the TCP analyzer which prevent the payload from reaching the<br>
signature engine. Nothing we'd really want to change though I think.<br>
<div><div></div><div class="Wj3C7c"><br>
Robin<br>
<br>
--<br>
Robin Sommer * Phone +1 (510) 666-2886 * <a href="mailto:robin@icir.org">robin@icir.org</a><br>
ICSI/LBNL * Fax +1 (510) 666-2956 * <a href="http://www.icir.org" target="_blank">www.icir.org</a><br>
</div></div></blockquote></div><br>