Log entire payloads

Vern Paxson vern at icir.org
Sat Apr 24 12:02:40 PDT 2004


> One possibility is to load the contents.bro script. It will write the
> contents of every connection to two files (contents-*), one for each
> direction. Note that it does writing for every connection, not just HTTP
> ones. If you want the latter, you might want to adapt the script
> accordingly.

Note, depending on your broader use, you can avoid adapting the script
by using capture_filters to only capture tcp port 80.

		Vern



More information about the Bro mailing list