[Bro] impossibly large packets

[William Jones]

Most network adapters have LRO on by default.   This can translate to large packets on bro input.   If you running bro on linux you see this behavior.



From: bro-bounces at bro-ids.org [mailto:bro-bounces at bro-ids.org] On Behalf Of Tim Ray
Sent: Monday, February 11, 2013 2:15 PM
To: bro at bro-ids.org
Subject: [Bro] impossibly large packets

Does Bro have any way to handle corrupt packets that appear to be impossibly large? When we get those in our setup, it hangs. Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130212/2f4a1f0d/attachment.html