[Bro] problem of multi-interface monitor?

亮 李 gefonty at yahoo.com.cn
Wed Dec 22 09:42:09 PST 2004


Hello,
when i execute "bro -i eth0 -i eth1 login.bro",bro only capture and deal with packets from eth0 and drop all from eth1.
 
"1103734623.487821:ContentGap:NOTICE_ALARM_ALWAYS::192.168.10.10:2422/tcp:192.168.10.77:23/tcp::::::192.168.10.10/2422         > 192.168.10.77/telnet content gap (> 69/11):"
 
after that,i emove "capture-filter ......" fom login.bro and try again,bro can capture and do rightly.
 
why? and how can i solve this problem?
 
sorry,i am not familiar whit BRO.
 



---------------------------------
Do You Yahoo!?
注册世界一流品质的雅虎免费电邮
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20041223/c14e2e2d/attachment.html 


More information about the Bro mailing list