[Bro] Capturing the raw trace...

[Robin Sommer]

On Wed, Oct 10, 2007 at 10:53 -0500, Randolph Reitz wrote:

> exists?  Does BRO have some secret way of preserving the libpcap  
> output (er, the BRO input)?

Nice picture. :) But try the -w option first; it records all of
Bro's input into a trace file.

Robin

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org