[Bro] Newbie question on Bro and NetBIOS protocol

[Seth Hall]

On Oct 16, 2014, at 8:18 AM, fasf safas <silusilusilu at gmail.com> wrote:

> 3. In Bro (under dns.log) i'm able to see only the query, but not its response...so i'm not able to see the netbios name.

That should be working.  The best way to help debug this would be if you provided us with a trace containing some packets that exhibit this problem.

Thanks,
  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/