[Bro] scheduled tasks on existing pcaps

[Robin Sommer]

On Wed, Jun 18, 2014 at 12:13 -0500, Mike Dopheide wrote:

> Do Bro's scheduled tasks run in real time or network time when a pcap is
> passed to it?  I'm assuming real time,

No, it's network time actually, which drives pretty much everything in
Bro so that output doesn't differ when running live vs from a trace.

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 *     robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 * www.icir.org/robin