[Bro] Create different file size from original one in HTTP File-extract

[Seth Hall]

On Jul 22, 2013, at 5:24 PM, JH YANG <joonysky at yahoo.com> wrote:

> Pcap hasn't any missed parts but the file from Bro created uncompleted file which doesn't have last parts of file(2277bytes)

I think that there is a bug in Bro that shows up like this in some cases.  This is unlikely a bug that any of us on the core team are likely to look into though because there is new "file" handling code that is coming soon and just generally works better all around.

Sorry for the probably unsatisfactory answer, but things will be even better soon! :)

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/