[Bro] ConnCompressor, TCP options

[Robin Sommer]

On Thu, Jan 06, 2011 at 15:50 -0500, you wrote:

> Why is initial packet faked and not passed as originally observed?

Because it is not completely stored at that point. For a
connection's initial packet, the compressor remembers only what's
necessary for later analyzing it in full if more packets are coming
in. That saves a lot of memory (and CPU actually) for things like
scans and floods because for all those connections, Bro needs hardly
any resources. 

> Can you disable the use of the compressor? If so, how ?

See other mail. For an offline trace analysis, you probably want to
do that.

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org