[Bro] udp_request and icmp_sent event handlers
Vern Paxson
vern at icir.org
Sat May 7 17:51:38 PDT 2005
> I met a problem that event handlers udp_request, udp_reply, icmp_sent
> doesn't work (i.e., they are not processed) when Bro read tcpdump data that
> consist of udp and icmp packets. I did load udp and icmp analyzers. I noticed
> that icmp_request and icmp_reply event handlers worked. Has anyone met
> the same
> problem?
udp.bro doesn't turn on a capture-all-UDP filter. So try adding
redef capture_filters += { ["all udp"] = "udp" };
- Vern
More information about the Bro
mailing list