[Bro] impossibly large packets

[Tim Ray]

What about VM ware? Does that also have an LRO setting in the virtual NIC? Or are there additional issues with VM ware and BRO and packets like this?

From: William Jones <jones at tacc.utexas.edu<mailto:jones at tacc.utexas.edu>>
Date: Tuesday, February 12, 2013 10:24 AM
To: Tim Ray <tray at 21ct.com<mailto:tray at 21ct.com>>, "bro at bro-ids.org<mailto:bro at bro-ids.org>" <bro at bro-ids.org<mailto:bro at bro-ids.org>>
Subject: RE: impossibly large packets

Most network adapters have LRO on by default.   This can translate to large packets on bro input.   If you running bro on linux you see this behavior.



From: bro-bounces at bro-ids.org<mailto:bro-bounces at bro-ids.org> [mailto:bro-bounces at bro-ids.org] On Behalf Of Tim Ray
Sent: Monday, February 11, 2013 2:15 PM
To: bro at bro-ids.org<mailto:bro at bro-ids.org>
Subject: [Bro] impossibly large packets

Does Bro have any way to handle corrupt packets that appear to be impossibly large? When we get those in our setup, it hangs. Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130212/aaa018cf/attachment.html