[Bro] http-body and binary content
Vern Paxson
vern at icir.org
Thu Oct 11 20:38:30 PDT 2007
> Any thoughts on why Bro changes its output based on the optional
> headers?
This almost for sure isn't the problem, as I don't believe there's any
code relating to looking at the headers in this regard.
> Or why it could be sometimes outputting binary and others
> ASCII Hex?
How are you using/printing the values recovered by Bro? Best bet is that
you're running into Bro introducing some escape sequences.
Vern
More information about the Bro
mailing list