[Bro] http-body and binary content

Vern Paxson vern at icir.org
Thu Oct 11 20:38:30 PDT 2007


> Any thoughts on why Bro changes its output based on the optional  
> headers?

This almost for sure isn't the problem, as I don't believe there's any
code relating to looking at the headers in this regard.

> Or why it could be sometimes outputting binary and others  
> ASCII Hex?

How are you using/printing the values recovered by Bro?  Best bet is that
you're running into Bro introducing some escape sequences.

		Vern



More information about the Bro mailing list