[Bro] modifying bro.init

Vern Paxson vern at icir.org
Thu Feb 4 17:40:31 PST 2010


> ignore the checksum errors, since now it's giving me an "unrecognized  
> character" error.

That usually means you left off a -r running against a trace, like

	bro foo.trace http-request

rather than

	bro -r foo.trace http-request

Bro is then trying to parse foo.trace as a script and the low-level scanner
flags an impossible (8-bit) character.

		Vern



More information about the Bro mailing list