[Bro] Forcing analyser on partial connections

sridhar basam sridhar.basam at gmail.com
Tue Jun 1 09:07:59 PDT 2010


I have some very long lived http connections where the capture file doesn't
have the tcp setup packets. Is there a way to force the analyser to run on
such partial connections? Anyway to twiddle the connection recods to run the
analyser you want?

thanks
-- 
Sridhar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20100601/e8ca1af5/attachment.html 


More information about the Bro mailing list