problems using Bro (http)

[Robin Sommer]

On Tue, Jun 15, 2004 at 16:55 +0200, rmkml wrote:

> $ /usr/src/bro/bro-pub-0.9a2/bro -i eth0 bro.init mt http

You should use "http-request" (and perhaps "http-reply") instead of
http. 

> and why bro write weird.log only after stop bro ?

Most of the log files are buffered, i.e. output is written in larger
chunks (and at termination). 

Robin

-- 
Robin Sommer * Room        01.08.055 * www.net.in.tum.de
TU Muenchen  * Phone (089) 289-18006 *  sommer at in.tum.de