[Bro] Fragmentation and TCP overlapping Issues

[Vern Paxson]

> Regarding fragmentation (question 1), I am running bro with this command:
> 
> bro $files todai-nets -f "tcp or udp or icmp" dpd_conn_logs=T dpd
> detect-protocols dyn-disable detect-protocols-http proxy ssh irc-bot brolite
> print-globals capture-loss

What happens when you use

	bro ... -f "tcp or udp or icmp or (ip[6:2] & 0x3fff != 0)" ...

?

> The variable $files contains 300 consecutive captured files (pcap) of 4 Gb
> each. In this experiment I am not getting any "fragment" event.

Again, we really need trace snippets to diagnose problems like these.  You
should extract a small subset of the trace that you believe should cause
behavior different from what Bro does.

		Vern