[Bro] Possible disable split_routing detecting ?

Vern Paxson vern at icir.org
Tue Sep 28 20:27:43 PDT 2004


> I use bro,
> 
> but not have more 1 link to InterNet,
> 
> Possible disable split_routing detecting/function ?

If it's not possible that you're seeing split routing, then it's important
to figure out why Bro believes it's seeing it.  You should capture a trace
using -w for which Bro reports split routing; see if running on the trace
off-line reproduces that message; and, if so, investigate the trace to
determine whether in fact the given connection is missing part of its
SYN/SYN-ACK pair.

		Vern



More information about the Bro mailing list