<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Command line is <br>
<blockquote><tt>bro -i eth0 ACF.bro</tt><br>
</blockquote>
ACF.bro is attached. The rest of my config is currently unmodified. I
could write the NetFlow to a tcpdump file. I hadn't thought to try the
-r switch. Thanks for the idea.<br>
<br>
-Andrew<br>
<br>
<br>
rmkml wrote:
<blockquote cite="mid:alpine.NEB.2.00.0810100704001.17269@znpzvav"
type="cite">Hi Andrew,
<br>
I don't help, but possible write traffic to tcpdump file ? (for replay
with bro)
<br>
what is your cmd line for starting bro please ?
<br>
maybe post your all file conf.
<br>
Regards
<br>
Rmkml
<br>
Crusoe-Researches.com
<br>
<br>
On Thu, 9 Oct 2008, Andrew Feren wrote:
<br>
<br>
<blockquote type="cite">Date: Thu, 09 Oct 2008 18:07:30 -0400
<br>
From: Andrew Feren <a class="moz-txt-link-rfc2396E" href="mailto:acferen@yahoo.com"><acferen@yahoo.com></a>
<br>
To: <a class="moz-txt-link-abbreviated" href="mailto:bro@ICSI.Berkeley.EDU">bro@ICSI.Berkeley.EDU</a>
<br>
Subject: [Bro] Bro and NetFlow
<br>
<br>
I built 1.4.prerelease.12 the other day to play around with several
<br>
parts of Bro including the NetFlow policies. I'm having good luck with
<br>
the rest of my investigations, but I can't seem to get Bro to react to
<br>
the NetFlow that is coming in.
<br>
<br>
I get a netflow.log file, but nothing ever gets logged.
<br>
<br>
NetFlow Version is 5.
<br>
<br>
I read through the policies and .pac files and I don't see a problem,
<br>
but I'm new to Bro and there is a lot to sort through.
<br>
<br>
Any thoughts on where I should start?
<br>
<br>
-Andrew
<br>
_______________________________________________
<br>
Bro mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:bro@bro-ids.org">bro@bro-ids.org</a>
<br>
<a class="moz-txt-link-freetext" href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro</a>
<br>
<br>
</blockquote>
<br>
</blockquote>
</body>
</html>