[Bro-Dev] [JIRA] (BIT-1257) Same file id generated for potentially different files
Jimmy Jones (JIRA)
jira at bro-tracker.atlassian.net
Mon Sep 22 02:15:07 PDT 2014
Jimmy Jones created BIT-1257:
Summary: Same file id generated for potentially different files
Project: Bro Issue Tracker
Issue Type: Problem
Affects Versions: 2.3, git/master
Environment: CentOS 6
Reporter: Jimmy Jones
Attachments: fa.bro, sample-samefileid.pcap
Attached sample contains two HTTP downloads of the same URL from the same client, but there are no guarantees that the files is actually the same (no Etags etc - in this case it actually is the same, but lets pretend they were different...). However the file analysis framework seems to give the same file ID in file_name and file_chunk for both downloads.
Think this is something to do with Range requests as doesn't happen if do "normal" HTTP requests.
This message was sent by Atlassian JIRA
More information about the bro-dev