[Bro] wrong size computation

Vincenzo Falletta falletta at ftw.at
Sat Dec 10 10:55:29 PST 2005


But if I turn on signature detection i.e. if I run

$bro -r to-brolist_anonym.pcap mt brolite-sigs

then I get AGAIN the same error... so what's up?

	Vince

Vern Paxson wrote:
>>Here it is a sample... it is just an handshake but if you run
>>
>>$bro -r to-brolist_anonym.pcap brolite
>>
>>you will see in the conn.log file the BIG computation mistake...
> 
> 
> Hmmm, this appears to be specific to brolite.bro.  If I run on the trace
> with mt.bro, it flags the sizes as "? ?", which seems fine in this case.
> We'll look into it further.
> 
> 		Vern
> 



More information about the Bro mailing list