[Bro-Dev] #1022: HTTP bogus events

[Bro Tracker]

#1022: HTTP bogus events
-----------------------+--------------------
  Reporter:  thorkill  |      Owner:
      Type:  Problem   |     Status:  new
  Priority:  High      |  Milestone:  Bro2.2
 Component:  Bro       |    Version:  2.1
Resolution:            |   Keywords:  http
-----------------------+--------------------

Comment (by seth):

 Ohh, well you're using the c$conn$missed_bytes value to determined missed
 bytes but I don't know the order that the content_gap event is generated
 (which is where that data comes from).  Ultimately the best thing would be
 if you could catch some of this traffic and get a tracefile to us.

-- 
Ticket URL: <http://tracker.bro.org/bro/ticket/1022#comment:4>
Bro Tracker <http://tracker.bro.org/bro>
Bro Issue Tracker