[Bro] udp_request and icmp_sent event handlers

Vern Paxson vern at icir.org
Sat May 7 17:51:38 PDT 2005


>       I met a problem that event handlers udp_request, udp_reply, icmp_sent
> doesn't work (i.e., they are not processed) when Bro read tcpdump data that
> consist of udp and icmp packets. I did load udp and icmp analyzers. I noticed
> that icmp_request and icmp_reply event handlers worked. Has anyone met 
> the same
> problem?

udp.bro doesn't turn on a capture-all-UDP filter.  So try adding

	redef capture_filters += { ["all udp"] = "udp" };

- Vern



More information about the Bro mailing list