[Bro] Finding SYNs...

[David Hoelzer]

Oops!  Sorry, yes.  Thanks!

I notice that you say “default behavior”.  Is there an enum or constant that I can adjust to change this behavior?

On Sep 8, 2014, at 10:16 AM, Siwek, Jon <jsiwek at illinois.edu> wrote:

> 
> On Sep 8, 2014, at 8:36 AM, David Hoelzer <dhoelzer at sans.org> wrote:
> 
>> I’m curious as to whether or not an invalid checksum as a result of offloading would prevent the tcp_SYN_packet event from firing…?
> 
> If you mean “connection_SYN_packet”, the default behavior is to not generate that event for packets w/ invalid checksums.
> 
> - Jon