[Bro-Dev] BiF parsing index types

Will baxterw3232 at gmail.com
Mon May 23 07:20:45 PDT 2011


On Mon, May 23, 2011 at 2:58 AM, Seth Hall <seth at icir.org> wrote:
>
> On May 18, 2011, at 3:56 PM, Will wrote:
>
>> The odd thing is, I don't know what changed that would cause these to
>> start occurring recently.
>
>
> It's usually that something has changed external to Bro.  Perhaps a DNS server that hosts on your network tend to do traffic with occasionally started returning odd responses.  This seems to be how most of the edge cases are found. :)

Yes, found this to be exactly the case. We built a new box and just
transferred over the same bro scripts and haven't had any problems.

Thanks!

>
>  .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro-ids.org/
>
>



More information about the bro-dev mailing list