[Bro] processing many files with bro

Vern Paxson vern at icir.org
Thu Mar 11 07:31:30 PST 2010


> ipsumdump --collate -w *.pcap | $BROHOME/bin/bro -r - brolite mysite

That needs to be:

  ipsumdump --collate -w - *.pcap | $BROHOME/bin/bro -r - brolite mysite

Unfortunately as you issued it, ipsumdump wrote the output to the first
file in the expansion of *.pcap, overwriting it :-(.

		Vern



More information about the Bro mailing list