[Bro] Specifying File Extraction Limit

Seth Hall seth at icir.org
Mon Aug 10 12:47:02 PDT 2015

> On Aug 10, 2015, at 2:53 PM, Damon Rouse <damonrouse at gmail.com> wrote:
> I seem to have having a similar issue with the way I was limiting the size of my extracted files too.  Under 2.3.2, popping the following redef in my local.bro worked perfectly:  redef FileExtract::default_limit = 25000000;
> Under 2.4, I have larger files being extracted like Jason.

Oh, interesting.  I don’t think we have a test case which covers that.  I suspect that it’s the file reassembly that was added into 2.4.  I filed a ticket to make sure we track this.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list