<div>Hi</div>
<div>my problem is not filtering but my problem is obtain accurate size of transfer byte <br>i have checked these policies and apply very much and understand them completly</div>
<div>but apply conn policy on 2 tcpdump file(that one include all of packet headers and other include only SYN,SYN_ACK,FIN packet headers) have different results</div>
<div>why????</div>
<div>thanks<br></div>
<div class="gmail_quote">On Sat, Nov 8, 2008 at 11:25 PM, rmkml <span dir="ltr"><<a href="mailto:rmkml@free.fr">rmkml@free.fr</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Hi hossein,<br>do you have checked policy/conn.bro|load conn|conn.log ?<br>example:<br>1225897841.708954 0.110102 <a href="http://10.100.11.8/" target="_blank">10.100.11.8</a> <a href="http://192.168.25.192/" target="_blank">192.168.25.192</a> https 44642 443 tcp 926 3545 SF X<br>
(926 and 3545)<br>for only tcp flags SYN,SYN-ACK,FIN: add tcpdump filter on bro cmd line ?<br>Regards<br>Rmkml<br>Crusoe-Researches.com<br><br>On Sat, 8 Nov 2008, hossein talebi wrote:<br><br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Date: Sat, 8 Nov 2008 22:21:29 +0330<br>From: hossein talebi <<a href="mailto:talebihossain@gmail.com" target="_blank">talebihossain@gmail.com</a>><br>
To: Bro-ids <<a href="mailto:bro@bro-ids.org" target="_blank">bro@bro-ids.org</a>><br>Subject: [Bro] how to measure size of data that transfer in connection?
<div>
<div></div>
<div class="Wj3C7c"><br><br>Hi<br> <br>i want measure size of data thet transfer in per side(how many recieve and how many send)<br> <br>I have downloaded one file with size:almost 4MB<br>and capture its with tcpdump(only with filtering on tcp header and on my IP )<br>
and sum of received data in connections almost is:4MB (this sum have been measured in Bro via field of endpoint size in connection) <br>then i filter same output of tcpdump only for tcpflags(SYN,SYN-ACK,FIN) and save with pcap format<br>
and sum of received data in connections almost is:1MB<br> <br>i don't know reason of this repugnance <br>i need measure size of data that transfer in per side of connection realy while i have filter network traffic only<br>
for SYN,SYN-ACK,FIN packet header<br> <br>how to solve this problem?<br> <br>please help me<br>thanks<br>--<br>Talebi Mazraeh Shahi Hossein<br><br></div></div></blockquote></blockquote></div><br><br clear="all"><br>-- <br>
Talebi Mazraeh Shahi Hossein <br>