[Bro-Dev] [JIRA] (BIT-1257) Same file id generated for potentially different files
Robin Sommer (JIRA)
jira at bro-tracker.atlassian.net
Wed Apr 22 08:10:01 PDT 2015
[ https://bro-tracker.atlassian.net/browse/BIT-1257?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Robin Sommer updated BIT-1257:
------------------------------
Fix Version/s: (was: 2.4)
2.5
> Same file id generated for potentially different files
> ------------------------------------------------------
>
> Key: BIT-1257
> URL: https://bro-tracker.atlassian.net/browse/BIT-1257
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Affects Versions: git/master, 2.3
> Environment: CentOS 6
> Reporter: Jimmy Jones
> Assignee: Seth Hall
> Fix For: 2.5
>
> Attachments: fa.bro, sample-samefileid.pcap
>
>
> Attached sample contains two HTTP downloads of the same URL from the same client, but there are no guarantees that the files is actually the same (no Etags etc - in this case it actually is the same, but lets pretend they were different...). However the file analysis framework seems to give the same file ID in file_name and file_chunk for both downloads.
> Think this is something to do with Range requests as doesn't happen if do "normal" HTTP requests.
--
This message was sent by Atlassian JIRA
(v6.5-OD-01-120#65000)
More information about the bro-dev
mailing list