[Bro] Why do I get duplicate new_connection event?

[Christian Kreibich]

Hi,

it's not clear to me why you see an additional new_connection event, but
I also don't understand why you apparently encounter content gaps,
because (after just eyeballing) I don't see any. Would you mind sending
that trace?

ps: it's a good idea to turn off linewrapping in your mailer when
sending log output.

Cheers,
Christian
-- 
________________________________________________________________________
                                           http://www.icir.org/christian
                                                    http://www.whoop.org