[Bro-Dev] Help creating new analyzer
Seth Hall
seth at icir.org
Fri Apr 15 05:31:12 PDT 2011
On Apr 14, 2011, at 11:57 PM, Kristin Stephens wrote:
> I'm create a new analyzer for Bro and am currently just trying to create a skeleton that does nothing, but compiles. I'm currently stuck at a compile error that I don't really know the meaning of "cannot handle incremental input"
Could you send along your .pac files? It usually has to do with a unit where you are trying to have a bytestring parsed until &endofdata, but the unit or the parent unit doesn't have a &length applied (I think).
.Seth
--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/
More information about the bro-dev
mailing list