[Bro-Dev] #1022: HTTP bogus events

Bro Tracker bro at tracker.bro.org
Thu Jun 20 02:08:02 PDT 2013


#1022: HTTP bogus events
-----------------------+--------------------
  Reporter:  thorkill  |      Owner:
      Type:  Problem   |     Status:  new
  Priority:  High      |  Milestone:  Bro2.2
 Component:  Bro       |    Version:  2.1
Resolution:            |   Keywords:  http
-----------------------+--------------------

Comment (by thorkill):

 It seems, that this connections does have missed_bytes, then why is this
 value at the time of the event 0? I have no idea, may be the content_gap
 occured later.


 {{{
 1370881915.933901       ngRQOFjBgsg     87.139.xxx.2xx  3916
 xx.xx.xx.xx     80      tcp     -       106.864390      4534779 8095    SF
 F       12064   ShADadfF        10077   14023089        5226    234741
 (empty)
 }}}

-- 
Ticket URL: <http://tracker.bro.org/bro/ticket/1022#comment:3>
Bro Tracker <http://tracker.bro.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list