[Bro] Specifying File Extraction Limit

[Seth Hall]

> On Aug 10, 2015, at 2:53 PM, Damon Rouse <damonrouse at gmail.com> wrote:
> 
> I seem to have having a similar issue with the way I was limiting the size of my extracted files too.  Under 2.3.2, popping the following redef in my local.bro worked perfectly:  redef FileExtract::default_limit = 25000000;
> 
> Under 2.4, I have larger files being extracted like Jason.

Oh, interesting.  I don’t think we have a test case which covers that.  I suspect that it’s the file reassembly that was added into 2.4.  I filed a ticket to make sure we track this.
	https://bro-tracker.atlassian.net/browse/BIT-1451

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/