[Bro] how to merge rx and tx from different pcaps / slightly off-topic

[Jeff Barber]

Seth, Thanks for the clarification.

Uggh... It appears that shady stuff my plugin is doing is responsible for
my problem.

I think the problem is that I have opened a live pkt src from within my
plugin, but then also trying to read a pcap. Maybe I've seeded BRO with a
later timestamp than those in the pcap? Having a hard time following the
timer logic.

Is it possible to instantiate a per-PktSrc timer?

Anyway, sorry to be spewing misinformation.


On Wed, Sep 9, 2015 at 9:55 PM, Seth Hall <seth at icir.org> wrote:

>
> > On Sep 9, 2015, at 5:09 PM, Jeff Barber <jbarber at computer.org> wrote:
> >
> > If you don't specify --pseudo-realtime, BRO will apparently run
> connection timers based on the current wall clock time, comparing the wall
> clock with the start time recorded in conjunction with the packets in the
> pcap. This means it may see a connection start, then immediately expire it
> as having passed the session time limit. [What? That session is six months
> old!]
>
> That’s actually not how Bro works, it uses the timestamps in the packets
> to drive it’s packet clock forward.  Could you show how you’re running
> Bro?  It sounds to me like you’re replaying traffic to and interface and
> then sniffing it.
>
>  .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150910/063a5282/attachment.html