[Bro] Bro and unusual http ports

[Seth Hall]

On Nov 20, 2012, at 1:27 PM, "Castle, Shane" <scastle at bouldercounty.org> wrote:

> This is giving me no joy on Bro 2.0, which barfs on seeing the "add" expression. When I try to emulate what base/protocols/http/main.bro does with


You need to make sure that add statement is outside of any event handler.  Are you putting it in a bro_init event handler? (it helps if you give us the error message you got when something didn't work) :)

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/