[Bro] problem of multi-interface monitor?
亮 李
gefonty at yahoo.com.cn
Wed Dec 22 09:42:09 PST 2004
Hello,
when i execute "bro -i eth0 -i eth1 login.bro",bro only capture and deal with packets from eth0 and drop all from eth1.
"1103734623.487821:ContentGap:NOTICE_ALARM_ALWAYS::192.168.10.10:2422/tcp:192.168.10.77:23/tcp::::::192.168.10.10/2422 > 192.168.10.77/telnet content gap (> 69/11):"
after that,i emove "capture-filter ......" fom login.bro and try again,bro can capture and do rightly.
why? and how can i solve this problem?
sorry,i am not familiar whit BRO.
---------------------------------
Do You Yahoo!?
注册世界一流品质的雅虎免费电邮
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20041223/c14e2e2d/attachment.html
More information about the Bro
mailing list