Log entire payloads
Vern Paxson
vern at icir.org
Sat Apr 24 12:02:40 PDT 2004
> One possibility is to load the contents.bro script. It will write the
> contents of every connection to two files (contents-*), one for each
> direction. Note that it does writing for every connection, not just HTTP
> ones. If you want the latter, you might want to adapt the script
> accordingly.
Note, depending on your broader use, you can avoid adapting the script
by using capture_filters to only capture tcp port 80.
Vern
More information about the Bro
mailing list